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Introduction 


This document describes procedures for using Wind River Workbench with the 
Wind River Probe and Wind River ICE emulators to bring up a target board, from 
the first power-up through running and debugging application code. 


This document includes the following chapters: 

1. Introduction - Introduces the document. 

2. On-Chip Debugging - Describes of the theory of on-chip debugging. 
3. Board Bring-Up - Provides an overview of board bring-up procedure. 


4, OCD Connections - Describes making an OCD connection to a target using a 
JTAG or BDM port. 


5. Tool Configuration - Describes hardware-specific configuration options for Wind 
River emulators. 


6. Board Initialization - Describes how to use Wind River emulators to initialize the 
target hardware. 


7. Verifying Hardware - Describes how to use Wind River Workbench to run 
hardware diagnostics on your target. 


8. Testing Memory - Describes how to use Wind River emulators to suspend CPU 
operations and force the target into background mode. 


9. Debugging in RAM - Describes how to create a project, download code and 
symbol information, set software breakpoints, and step through code. 


10. Programming Flash Memory - Describes working with flash memory on your 
target. 
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11. Debugging in ROM - Describes using hardware breakpoints to debug in ROM. 


A. Pins Mapped to Common Signals - Provides a mapping reference for Wind 
River-supported processor families. 


B. Internal Breakpoint Capabilities - Provides a detailed reference for line, expression, 
and hardware breakpoints in Workbench. 


C. Pin Terminations - provides a detailed reference of pinouts for Wind 
River-supported processor families. 


On-Chip Debugging 


Almost all embedded systems have hardware and software elements, which are 
separate but interdependent. Since embedded systems generally do not have 
keyboards, or any kind of user interface, debugging of their software elements 
must be done externally. 


An older solution to this problem was the in-circuit emulator, which substituted its 
own internal processor for the central processing unit (CPU) of the embedded 
system. 


However, in-circuit emulators are expensive; and since they are made by 
third-party vendors, there is often a long delay between a new target and a new 
in-circuit emulator that can attach to it. A cheaper, and more easily implemented, 
solution is on-chip debugging (OCD). 


Many semiconductor manufacturers now integrate dedicated debug 
microcircuitry into their chips. This approach adds hardware and software debug 
capability to the existing JTAG or BDM ports. Since the debug operations occur on 
a dedicated area of the chip itself, this solution is known as on-chip debugging. 


OCD combines many features of software debug monitors and in-circuit 
emulators. Like an in-circuit emulator, OCD provides low-level hardware access. 
It does not need to use target memory; it does not need a target communication 
channel; and, for some processors, it can edit memory and registers without 
halting the processor. Like a software monitor, OCD lets you set breakpoints, stop 
and start the CPU, step through code, examine memory, and run diagnostic tests; 
but unlike a software monitor, OCD does not need good hardware to run. 


Software defects that cause the operating system to crash will typically cause an 
agent-based debug environment to fail. However, since an OCD connection is 
implemented in the hardware, it is not as sensitive. 


Table 2-1 
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An OCD connection remains active even on bad hardware. Using an OCD 
connection, you can download low-level software even when the target board is 
not functioning correctly, and the boot loader cannot run. 


On-chip debugging capability varies from one processor family to another, but the 
provided functionality is generally similar. Most processors use the following 
primitives for Background Debug Mode (BDM): 


OCD Primitives 


Command Mnemonic Description 

Read Register RDREG Read a data register and return the value. 
Write Register WDREG Write a value to a data register. 

Read Memory READ Read from a memory location. 

Write Memory WRITE Write to a memory location. 

Stop Processor BGND Assume control of the bus and put processor in 


background mode. 
Single Step STEP Step one instruction. 


Resume GO Resume execution at the program counter's 
current location. 


Wind River tools use these low-level OCD primitives as building blocks to create 
a higher level of primitives, thus allowing hardware and software verification. 


OCD commands invoked while the processor is running “steal” bus cycles from 
the CPU in the same way a Direct Memory Access (DMA) controller does. 


As the debugger reads and writes to memory and registers, it halts the CPU and 
restarts it. The CPU is not involved in OCD operations. The BGND instruction from 
the OCD hardware causes the CPU to halt, and the OCD hardware assumes control 
of chip operations. A GO (Resume) command flushes OCD operations and restarts 
the CPU. 


The Wind River Probe and Wind River ICE SX tools use the on-chip debug 
capabilities embedded in the target processor. These tools are not true in-circuit 
emulators, because they do not replace the target CPU with their own internal 
processor. However, the functions they perform are similar, and this document will 
refer to them as “emulators”. 


2 On-Chip Debugging 


OCD has many advantages over in-circuit emulation. It is cheaper; the debug 
hardware is included by the silicon manufacturer, not by a third party; and unlike 
an in-circuit emulator, the OCD hardware does not lag behind chip releases. 


When you access the OCD services on the chip, all interaction between the 
Wind River Probe or Wind River ICE SX and the target runs exclusively through 
the OCD connection. This means that your system is effective for the entire 
development process, even before board-level peripherals are stable. 


ColdFire processors, and some older PowerPC processors (5xx and 8xx) use a 
dedicated BDM port for OCD operations. A more recent approach is to attach the 
OCD functions to the Joint Test Action Group (JTAG) interface to communicate to 
the target CPU, and share this interface with boundary-scan board-circuit testing. 
The JTAG interface follows the IEEE 1149.1 boundary-scan (JTAG/Test Interface) 
specification. 


The JTAG interface consists of a set of five signals, three JTAG registers, and a test 
access port (TAP) controller. The TAP controller is typically embedded in the target 
microprocessor or device. The information related signals are TDI (Test Data In) 
and TDO (Test Data Out). The boundary-scan register chain (data) includes 
registers controlling the direction of the input/output drivers, as well as registers 
reflecting the signal value received or driven. The expectation and details of 
particular CPU chains are encoded directly into the emulator firmware. 


Each device sharing the JTAG interface employs a serial stream of relative data. 
The data streams for all devices can be chained together. An associated process can 
scan the combined chain to extract any particular device’s information. 


For further information about JTAG operations, refer to the IEEE 1149.1 
specification at http://standards.ieee.org. 


Wind River emulators are non-intrusive; that is, they do not use target resources. 
An emulator will not affect target memory, stack space, or the flash workspace. 


On-chip debug agents reside inside cache and memory management units they 
share the chip with, so the OCD hardware sees address and data values just like 
the CPU sees them. Some processor families have dedicated output signals (other 
than the JTAG pins) that can deliver information on the state of the processor. 
Combined with external hardware (such as the Wind River ICE SX, in conjunction 
with the Wind River Trace tool) these signals can log the real-time code execution 
history to a trace buffer. This data is helpful when you need to debug problems that 
only occur when the processor is running at full speed. 


There is an industry standard, not yet widely adopted, created by the Global 
Embedded Processor Debug Interface Forum, formally called IEEE-ISTO 5001. For 
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the standard, and a good deal of further information, see 
http://www.nexus5001.org/standard.html. 


Board Bring-Up 


3.1 Goals and Objectives 7 


3.2 Sequence of Events 7 


3.1 Goals and Objectives 


This chapter provides a general overview of board bring-up procedure. 


The goal of a board bring-up procedure is to verify the operation of a target board, 
all the way from power-on to successfully running and debugging code. 


3.2 Sequence of Events 


In general, the procedure of bringing up a board uses the following outline: 


» Attempt a “smoke test”- that is, see if you can apply power to the board 
without damaging it. 


« Perform a “lamp check” - turn the LEDs on and off 


= Establish a JTAG or BDM connection to the emulator. 
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« Configure the emulator-target interface: set voltage, clock rate, signal logic. 
« Enter background mode. 

« Read and write core registers. 

« Configure the target workspace. 

«Run simple RAM tests. 

« Run bus tests on the address and data buses. 

« Test low-level stepping and breakpoints. 

« Execute low-level code. 

« — Test source-level stepping and breakpoints. 

« Execute application. 

« Debug application code in RAM. 

« Test the target’s ability to erase and program flash memory. 


« Debug application code in ROM. 


OCD Connections 


4.1 Debug Connections 9 
4.2 Creating a Target Connection 10 


4.1 Debug Connections 


To create a target connection, create projects, and download code, you need a 
Wind River Probe or a Wind River ICE SX. 


For software-only tests, you can create a simulated connection using the Wind 
River Instruction Set Simulator (ISS), which is available to all users of Wind River 
Workbench OCD Edition. For instructions on using the Instruction Set Simulator, 
see the Wind River Workbench On-Chip Debugging Guide. 


The instructions in this document use a Wind River Probe connecting to a MIPS 4kc 
target. The process for connecting with the ICE is similar; for instructions on 
connecting with a Wind River ICE SX, see the Wind River ICE SX for Wind River 
Workbench Hardware Reference. 
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4.2 Creating a Target Connection 


To establish a connection with the Wind River Probe, use the following steps. 
1. Launch Wind River Workbench according to the method for your host. 
Linux/Solaris Hosts 

From your installation directory, issue the following command: 


S$ ./startWorkbench.sh 


Windows Hosts 


Select Start > Programs > Wind River > Wind River Workbench 2.6.1 > Wind 
River Workbench 2.6. 


Wind River Workbench launches. 
2. Specify a workspace. 


For Windows hosts, Workbench displays a dialog where you can specify a 
location for your workspace. For Linux hosts, the workspace defaults to 
installDirlworkspace. 


After you specify your workspace, Workbench opens and the Quick Target 
Launch dialog appears. 


Wind River On Chip Debugging 
@ Choose How You Want to Start 


Defined Launches 


EY Create a new launch configuration 
{E:) 


Edit an existing launch configuration 


Connect, Attach, Reset and Download 


Sync with target and download symbols 


Do not show this dialog on startup 
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4 OCD Connections 
4.2 Creating a Target Connection 


The Quick Target Launch dialog allows you to create a launch configuration 
to initialize your target and download symbols and code. Once created, the 
launch configuration is persistent, so you can return to it at any time. 


If this is the first time you have launched Workbench, the only available option 

is Create a new launch configuration. The next time you open Workbench, the 
Quick Target Launch dialog will give you the option of re-launching the same 

launch configuration or creating a new one. 


3. Select Create a new launch configuration. 


The New Connection Wizard appears. 


‘~W) New Connection 


Connection Type 


Please select connection type. 


Wind River Generic GDB Remote Serial Protocol Connection 
Wind River Linux KGDB Connection 

Wind River Linux User Mode Target Server Connection 
Wind River OCD ICE Connection 

Wind River OCD 15S Connection 

Wind River OCD Probe Connection 


Cancel 


4. Select Wind River OCD Probe Connection and click Next. 


The Processor Selection dialog appears. 
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% New Connection 


Wind River Probe Settings 
Configure the designator settings For the emulator. 


Designators 


©)Processor: | 4Kc | (select... } 


O Board file: 


¥  Designator Processor Processor Plugin 
MI) 4ke 4Ke MIPS32 Family Processor Plugin 


Auto-attach to connected designators 


Communications 


USB Device Name: PRO40310 


5. Click Select. From the list that appears, expand MIPS32 and select 4kc. 
6. Click OK. 

You are returned to the Processor Selection dialog. 
7. Click Next. 


The connection wizard passes through several additional screens. For the 
purposes of this chapter you do not need to use these screens. Click Next until 
you come to the Connection Summary. 
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4 OCD Connections 
4.2 Creating a Target Connection 


4 New Connection 


Connection Summary 


Please review the connection information 


Connection name: | WRProbe_4Ke 


Summary 


Property Value 
ADDR PRO40310 
AutoAttachConnectedCon true 

f DESIGNATORMAP 
DEVICE Wind River Probe 
NAME_MAPPING (*;*.unstripped],[*;*] 
PATH_MAPPING (Jd 
STYLE USBDEVICE 


Immediately connect to target if possible 


Ce) 


8. Make sure that the Immediately connect to target if possible checkbox is 


selected and click Finish. 


Workbench creates a target connection called WRProbe_4kc in the Target 


Manager view. 


9. Inthe Target Manager view, click on the “+” sign next to the WRProbe_4kc 


target connection name to expand it. 


Before Workbench can actually talk to the processor on the target system, 


Workbench must attach to the core. 


10. Right-click on 4kc [connected - stopped] and select Attach to Core. 
Workbench is now attached to the core, and able to talk to the processor. 


11. In the Workbench toolbar, select Window > Show View > OCD Command 


Shell. 
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The OCD Command Shell opens. 


#7 ocD Com... X Flash Pro... | CF Options OCD Stat... Hardwar... Cache Trace ~ O 


The prompt in the OCD Command Shell will read either >BKM> (background 
mode) or >ERR> (error.) 


There are several reasons an >ERR> prompt might appear; these will be addressed 
further on. 


The next step is to configure the emulator by setting certain configuration options, 
as described in 5. Tool Configuration. 
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5.2 Tool Configuration 16 


5.1 Introduction 


Wind River emulators can be configured in several different ways to specify 
various settings such as electrical properties, connection logic, and clock rate. To 
configure these settings Workbench uses configuration options, or CF options, which 
you can set in the OCD Command Shell. 


This document only describes the most important CF options, ones that are 
common to all Wind River-supported processor families. For a full description of 
all Wind River CF options sorted by processor family, see the Wind River Workbench 
for On-Chip Debugging Configuration Options Reference. 
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5.2 Tool Configuration 


At the prompt in the OCD Command Shell (either >BKM> or >ERR>) enter the 
command CF with no arguments. 


This displays a list of all CF options available for your target processor, along with 
their current settings. 


>ERR>cf 
Target CPU TAR[4KC, 4KM, 4KP, 4KEC, 24KC, 24KF, PR1910, PR3940, PR4450, 
PNX3001, PNX7350, PNX832X, PNX852X, PNX8535, PNX8550, 
BCM1100,BCM1101,BCM1103,BCM1104,BCM1190,BCM3345, 
BCM3 349 ,BCM3350,BCM3351,BCM3352,BCM3360,BCM3560, 
BCM4704,BCM5365,BCM5836,BCM6345,BCM6348,BCM6550, 
BCM7100,BCM7115,BCM7312,BCM7318,BCM7400,BCM7401, 
AU1100,AU1200, RC32332,RC32334,RC32355,RC32364, 
RC32365 ] = 4kKc 
Monitor Target Reset RST[YES,NO,HALT,RUN] = YES 
Set BreakPoint SB[SB,IHBC] = SB 
Set Work Space WSPACE[BASE and SIZE] = a0000000 1000 
Set Stack Range STACK[OFF / LOWER and UPPER] = OFF 
Emulator HRESET Control HRESET [ENABLE, DISABLE] = ENABLE 
BDM Clock Rate CLK[0.1,0.5,1,3,6,12,16] 
Drive TRESET Line TRESET[OPENC,ACTIVE] = OPENC 
Target Console Redirection TGTCONS [BDM, COM1,COM2] = BDM 
Step in Delayed slot SIDS[YES,NO] = NO 
Little Endian Mode LENDIAN[YES,NO] = NO 
>ERR> 


5.2.1 Clock Rate 


The CLK option controls the rate at which the JTAG clock (or BDM clock) clocks 
debug commands to the target. 


Available clock rates, and default settings, vary between processor families. Enter 
CF at the prompt and look for CLK in the list of CF options to see the available clock 
rates for your target. 


For a MIPS 4kc target, the available rates (Shown above) range from 0.1 to 16. The 
default is 16. To change the clock rate, say from 3 to 16, use the following 
command: 


>ERR>cf clk 16 
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5.2.2 Drive TRESET Line 


The TRESET option controls the logic applied to the target reset (TRESET) signal 
on the target. 


The option can be set to OPENC or ACTIVE. It is set to ACTIVE by default. 


When set to ACTIVE, the emulator uses transistor-transistor logic (TTL.) The 
emulator drives the TRESET signal to both active and inactive states. On some 
targets, the conditioning resistors cause excessive rise or fall time on the signal 
when returning to an inactive state. This excessive time can cause the processor to 
come out of reset in an incorrect state. 


When set to OPENC, the emulator uses open-collector logic. The active driver is 
released by tri-stating the line and allowing conditioning resistors on the target to 
return the signal to the non-active state. 


If you are driving the TRESET signal with an external line, you should set the 
emulator to use open-collector logic. Otherwise you could have an external line 
driving the TRESET signal LOW while the emulator is driving it HIGH, thus 
causing bus contention and possible damage to the target or the emulator. 


To set the TRESET option to OPENC, use the following command: 
>ERR>cf£ treset openc 
To change it back, use the following command: 


>ERR>cf£ treset active 


5.2.3 Monitor Target Reset 
The emulator continuously monitors the TRESET signal. If a target reset occurs, the 
emulator takes one of the following actions: 


« YES - If a target reset occurs it is reported to the user, and the target is forced 
out of background mode. 


« NO-Ifa target reset occurs it is ignored. This is normally used if the code 
contains a reset instruction, which causes a reset to the external hardware, but 
does not reset the core. 


" HALT - If a reset occurs, the target is trapped at the restart vector. 
« RUN-Ifareset occurs, the target is restarted and remains in background mode. 


By default, this option is set to YES. When set to YES, the target will start running 
code after each reset. If you are doing low-level work -- for example, if you are 
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examining register settings -- you may want the target to halt after a reset so you 
can get a target snapshot. To set this option to halt the target on a reset, use the 
following command: 


>ERR>cf£ rst halt 
To change it back, use the following command: 


>ERR>cf£ rst yes 


5.2.4 Emulator HRESET Control 
By default, the emulator asserts the hardware reset (HRESET) signal when 
initializing the hardware. 


To configure the emulator not to assert the HRESET signal when it initializes the 
board, use the following command: 


>ERR>cf£ hreset disable 
To change it back, use the following command: 


>ERR>cf£ hreset enable 
5.2.5 Saving Changes 


Most changes to configuration options do not take effect until you initialize the 
board, as described in 6. Board Initialization. 
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6.1 Introduction 


In order to establish communications with your target, you must first initialize it. 
Also, if the code you are running on your target causes the connection to be lost, 
you must initialize the target to restore that connection. Initialization is also 
required if you change the register settings in the emulator and want them to be 
reflected in the target. 


The target is initialized whenever you first establish a connection using your 
emulator. If you need to initialize the target when you are debugging, you can do 
it using the IN or INN initialization commands, as described in this chapter. 
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6.2 Background Mode 


In order for the emulator to work with the target, it must stop the target CPU and 
put the target in background mode. When the target is in background mode, a 
>BKM> prompt appears in the OCD Command Shell. 


If an >ERR> prompt appears in the OCD Command Shell, the target is not in 
background mode. 


6.2.1 The INCommand 


The IN command does two different things. First, it places the target board into 
background mode. Second, it copies all of the register information that is stored in 
the emulator’s NVRAM down to the target. 


To initialize the board and enter background mode, enter the following command: 
>ERR> in 


The IN command may fail for several reasons. For example, if you have not 
connected power to the target board, the output will resemble the following: 


>ERR>in 

KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KK KEK KKK KKK KKEKKKKK KKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KOR KKK KKK KKK KR KKK KK KK KKK KK KK KKK KKK KK KK KKK KK KKK KKK KKK KKK KKK KR KKK KKK KKK KKK KKK KKK 


Support Expires....... 4/20/06 

Target Processor...... AKC:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Failed 
Testing Communications to Hardware Interface....Passed 
Deiving HRESET to be High. c.«.6c4 e264 sae eee ae Passed 
Deriving HRESET to be: LOW..c.sesaesee sees edvww see Passed 
Waiting HRESET Low Acknowledge...............5.- Failed 
>ERR> 


For a list of the tests the emulator runs during an IN sequence, see 6.2.2 Set Verbose 
On, p.20. 


6.2.2 Set Verbose On 


To see the tests the emulator is running while attempting to enter background 
mode, put the emulator in verbose mode using the following command: 
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>ERR>set verbose on 


Then enter the IN command again. 


Here is a brief description of the tests with some possible reasons why each test 
might fail. 


Testing Communications to Hardware Interface 


This tests the hardware connectivity, and examines the communications path 
between the host and the emulator. If the test fails, ensure that you have the power 
properly connected and turned on, that the emulator is correctly connected to the 
host computer, and that your emulator hardware is properly connected to the 
target. 


Driving HRESET to be High 


This function tests the RESET signal to verify that it is HIGH. The emulator is not 
driving the RESET signal during this test, so the target must drive the RESET signal 
via a pull-up resistor. If this test fails, check to see if the target board has a pull-up 
resistor on the RESET signal to the HRESET pin of the connector. Also, check the 
target board reset logic and verify that it is not continually driving RESET LOW. 


Driving HRESET to be Low 


The RESET signal is a bi-directional signal for your unit. The emulator drives the 
RESET signal LOW and clocks it back in to verify that it is LOW. If this test fails, 
you may have contention on your RESET signal. Check to see if a device on your 
target board is continually driving RESET HIGH. Verify that the device on your 
target board that is driving the RESET signal is an open-collector device with a 
pull-up resistor. 


Attempting JTAG Communication 


During this test, the emulator stops the processor and attempts to establish JTAG 
communications. If this fails, check to see that your hardware is connected 
properly, and that the tests preceding this one passed. It is also possible that there 
is contention on your board. 


Waiting for HRESET to be Released 


The emulator only drives RESET low for a specified period of time. After RESET is 
driven LOW for the allotted time, it tri-states the RESET driver and clocks the 

RESET signal back in to see if the RESET signal went high. It continues to check for 
RESET to go high until is sees it go high or until you type Ctrl+X. If this test fails, 
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check to see if your target board reset logic is still driving the RESET signal LOW. 
Also check that your target board has a pull-up resistor to drive RESET HIGH. 


Testing for Target STOP State 


This test verifies that the processor stopped during the preceding JTAG 
Communications test by polling the processor status. If the target is still running, 
this test fails. 


Comparing Target CPU With CF Setting 


This test verifies that the emulator is properly configured for the appropriate target 
processor by comparing the processor type on your target with the processor type 
specified in your board file. If the test fails, use the CF TAR command to properly 
configure your target. For example, if you are using a MIPS 4kc target, and this test 
fails, enter the following commands: 


>ERR>c£ tar 4kc 
>ERR>in 


Loading Internal Registers 


Once background communications are established, the emulator downloads 
register values from the debugger NV-RAM to the target. It will only download 
register values for those register groups that are enabled. If this test fails, see the 
information in 6.3 The INN Command, p.23. 

Testing JTAG Communication 


This test examines the JTAG communication between the emulator and the target 
using the internal clock rate for which the emulator is configured. If this test fails, 
set the internal clock to a lower rate using the following command: 


>ERR>c£ clk value 


Attempting to restore CPU context 


This test restores the processor scan chains. 
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6.3 The INN Command 


In order to get a processor into background mode, the emulator asserts the RESET 
line of the processor and then releases it. The processor and its peripherals on the 
target board are forced into their reset state, and all of the internal registers are 
forced to their manufacturer’s reset value. 


The INN command places the target in background mode without overwriting the 
target’s registers, leaving them in their default reset state for the processor. 


If the IN command fails to put the target in background mode, enter the following 
command: 


>ERR>inn 

KEK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KEKE KKK KKKEKKKEKKKKK KKK 
Wind River Probe Initialization Sequence. 

Copyright (c) Wind River Systems, Inc. 1999-2005. All rights reserved. 


KR KKK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK 


Support Expires....... 4/20/06 
Target Processor...... AKC:U1 
Wind River Probe Group ID#= 0 
Wind River Probe Serial#= U1234567 Firmware= pr3.3_qa6 
Type CF For a Menu of Configuration Options 
Initializing Background Debug Mode.............. Successful 
>BKM> 
Generally, if an IN command fails but an INN succeeds, it is usually caused by 


incorrect register values in the emulator's NVRAM. 


To configure register values, see 6.4 Registers, p.23. 


6.4 Registers 


Your emulator includes an area of non-volatile memory (NVRAM) where you may 
store register settings for a target. 


Once the register values are present in NVRAM, they are automatically loaded to 
the target after each cold start, warm start, or IN initialization command. You can 
select which register values are written to the target by enabling and disabling the 
appropriate register groups. 


Wind River uses low-level SCGA commands to configure registers. Since 
configuring registers manually would require entering a large number of SCGA 
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commands, Wind River provides register files for many targets. A register file is a 
Workbench-specific script that you can execute in the OCD Command Shell. 


Register files are ASCII files using the extension .reg. For example, a register file 
for the Wind River MIPS 4kc target is 4kc_MALTA.reg, located in 
installDirlworkbench-2.x/dfw/build/host/registers/mips. 


6.4.1 Downloading a Register File 


To download a register file to the emulator, use the following steps: 
1. Inthe OCD Command Shell, click the Settings button. 
The OCD Command Shell Settings dialog appears, as shown in Figure 6-1. 


Figure 6-1 OCD Command Shell Settings 


® OCD Command Shell Settings 


OCD Command Shell Settings 


4kc 


PlayBack File | bench-2.6\dfwi0155ihostiregisters\mipsi4Kc_MALTA. regina |¥| Display Background Communications 


Input Log File (| ¥ | |_| Append 
Full Log File v Append 


Next to the PlayBack File field, click Browse. 

Navigate to the register file you wish to use and click Open. 
Click OK. 

In the OCD Command Shell, click the Playback File button. 


Sr ae 7 


The register file you selected is downloaded to your target. The commands 
from the file appear in the OCD Command Shell. 


This procedure only sets the register values in the emulator’s NVRAM, not on the 
target. To copy the register values from the emulator to the target, you must 
initialize the target with the IN command: 
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>BKM>in 


Only enabled register groups are copied to the target. 


6.4.2 Enabling and Disabling Register Groups 


If you look at the 4kc_MALTA.reg register file, you will see that it ends with 
several lines that begin CF GRP. Registers are stored in logical register groups. 
When you issue an IN command, the emulator only copies down register settings 
for register groups that are enabled. Register groups that are disabled on your 
target do not have register data transferred. 


Disabling a register group enables you to view the target register value, but 
prevents it from being overwritten during target initialization. 


NOTE: If you change a register value directly on the target of a register group that 
is disabled, that register does not get overwritten by the emulator during an 
initialization. Note, however, that the processor may still reset that register value 
to the processor default during a target initialization. 


To enable or disable a register group on your target, use the following steps: 
1. At the >BKM> prompt, type the command CF GRP. 

The first register group appears, as shown below: 

>BKM>c£ grp 


Group (CF GRP (M/S) Name = ENABLED/DISABLED 
CUSTOM (O0=Disable 1=Enable) Enabled > 


The name of the register group is displayed, along with its current status 
(either ENABLED or DISABLED). 


2. Type 1 to enable the group or 0 to disable it. 


3. To leave the setting as it is and advance to the next register group, press the 
ENTER key without typing 0 or 1. 


4. Continue through the list of register groups enabling and disabling them as 
required. 


5. When the register groups are enabled or disabled, type CF UPLOAD GROUP at 
the >BKM> prompt. 


This displays a list of all of the register groups on your target with their current 
settings as shown below: 


>BKM>c£ upload group 
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CF GRP GT64260_CPU ENABLED ; GROUP 
CF GRP GT64260_SDRAM ENABLED ; GROUP 
CF GRP GT64260_DEVICE ENABLED 7; GROUP 
CF GRP GT64260_GPP ENABLED ; GROUP 
CF GRP GT64260_MPP ENABLED ; GROUP 
>BKM> 


6.4.3 Modifying Registers Manually 


Wind River supplies register files for Wind River evaluation boards, as well as for 
many third-party target boards. 


If you are using a target for which Wind River does not supply a register file, you 
may have to create one. For instructions on creating register files, see the Wind 
River Workbench for On-Chip Debugging User Tutorials: Configuring Target Registers. 


Remember that the register file sets the register values in the emulator NVRAM, 
not on the target. The emulator copies the values you set in its NVRAM down to 
the target when you initialize the target with an IN command. Without a register 
file, the NVRAM contains default register values, typically made for a Wind River 
evaluation board, which most likely are not suitable for your target. So the IN 
command will not set the target registers properly. 


Some target processors come with default register settings. If your target has 
default register settings, you can modify the registers directly on your target 
manually, at least to the point where you can download your boot ROM 
application code. 


Remember that if you modify your registers manually, any initialization command 
or target reset will overwrite your changes. 


To modify registers manually, use the Registers view in Workbench. The Registers 
view lets you examine the bit-level detail for each register. The following sections 
describe the Registers view and the bit-level detail provided. 


The Registers View 


When the Registers view is open in Workbench, all of the register groups for your 
target are displayed with + signs beside them. Clicking on a + sign expands the 
register group, showing all of the registers that are included in that register group 
along with the value that they are currently set to. An example of an expanded 
register group is shown in Figure 6-2. 
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Expanded Register Group 


Local Yariables Memory 3B Registers x 


Ra Ce Ca Y 


Name Enabled Value 
+ GPR 
+ CTRL 
+ MMU 
+) FPU 
BSIPMON 
= icke ox00000000 
FI ox00 
E Ox0 
pmet 0x00000000 
pmc2 ox00000000 
pmc3 ox00000000 
pmct+ ox00000000 
+ mmerO ox00000000 
+ mamerd ox00000000 
sia ox00000000 
+ L2CACHE 
+ THERMAL 


< 


NOTE: Figure 6-2 is only an example of an expanded register group. The groups 
and the register values vary widely depending on your target architecture. 


Bit-Level Detail 


You can view the bit-level detail for any register by clicking on the + sign beside 
the register in the register group. 


NOTE: Before you can make any changes to your register settings, you need to 
enable the register group that contains the register you want to modify, so that the 
values download to the target when you initialize your system. If you do not 
enable the register group, you can still modify the settings in the emulator but not 
on the target. For more information, see 6.4.2 Enabling and Disabling Register 
Groups, p.25. 


You can make changes to any of the register settings by modifying each of the 
bit-level settings for any register. 


To modify bit-level values for your target, complete the following steps: 
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1. Inthe Registers view, double-click on the name of the register you wish to edit. 


This opens the Properties view, which shows the name of the register you have 
selected under the Property heading and its current setting under the Value 
heading, as shown in Figure 6-3. 


Properties View 


Value 


oxo CU 


Disable instruction cache throttling 
obo 

0 

oo 


2. Select the value under the Value heading and edit it as necessary. 


3. Inthe Registers view, click Refresh Values. The register information 
reappears with your changes. 


NOTE: Some registers are write-protected and cannot be edited. 


For more information on registers, including creating custom registers and register 
groups, see the Wind River Workbench for On-Chip Debugging User Tutorials: 
Configuring Target Registers. 


When you have initialized your target and entered background mode, with a 
>BKM> prompt showing in the OCD Command Shell, you can proceed to test your 
hardware, as described in 7. Verifying Hardware. 
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7.1 Introduction 


This chapter describes several tests and diagnostics you can use to verify that your 
hardware is working correctly. 


7.2 Setting a Workspace 


NOTE: The RAM workspace has no relation to the workspace that Workbench uses 
to store project information. 


The workspace is an area of RAM on the target that the emulator uses to download 
the hardware diagnostic routines and flash programming algorithms. 
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You must tell your emulator where writable RAM is located on your target for this 
purpose. 


Depending on the device family and type, this space is limited to under 2 KB. Note 
that more memory improves the speed of programming. 


To configure the workspace, enter the parameters using the syntax 
CF WSPACE base size 


where base is the start address, and size is the minimum number of bytes of target 
RAM required. 


To find the base and size values for a Wind River-supported target, consult your 
target’s target.ref file, located in installDir/vxworks-6.x/target/config/yourTarget. 
Alternatively, consult your processor documentation. 


For example, say the base of the workspace is 00000000 and the size is 6000. To set 
the workspace, enter the command 


>BKM>c£ wspace 0 60000 


This sets the workspace at address 0 with a size of 0x00006000 bytes. 


7.3 Diagnostic Functions 


Wind River Workbench provides a set of RAM and bus diagnostics and utilities 
that can be controlled by the emulator or run on the target. 


Some of the following tests can run code directly on the target instead of through 
the emulator by selecting the Run on Target checkbox. This allows the test to run 
at the execution speed of the target processor. 


7.3.1 Simple RAM Test 


This test writes and reads back a simple pattern to the memory bounded by the 
starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address are displayed 
in the Output field. 
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The first diagnostic to be run is a Simple Ram Test on the area of memory used by 
the workspace. 


J, 


on 


4 
a: 
6 
7 


In the Workbench toolbar, select Window > Show View > Hardware 


Diagnostics. 


In the Diagnostic field, select Simple RAM Test — Single Pass. 


The workspace cannot be used to test itself, so make sure the Run on target 


checkbox is unchecked. 


In the Start Address field, enter 0. 
In the End Address field, enter 6000. 
In the Units field, select LONG. 


Click Run. 


Workbench displays the test result in the Output field. The output of a successful 


test will resemble that in Figure 7-1. 


Successful Simple RAM Test 


Tasks Problems Properties Build Console Error Log OCD Command Shell © Hardware Diagnostics % 


Choose Diagnostic 
Diagnostic 


Simple RAM test - Single pass 


Description 


he Single RAM Test Single Pass writes and reads back a 
imple pattern to the memory bounded by the starting 
ind ending addresses entered in the fields below, IF an 
rror occurs, the test stops and the error type and 
ddress will be displayed. 


Start address: | oxoo000000 
End address: [ ox00006000 


Units LONG 


{JRun on target 


imple ram test running 
est complete 


If the test fails, the Address Bus Test diagnostic and the Data Bus Test diagnostic 
may determine the cause of the failure; see 7.3.5 Bus Tests, p.34. 


If the RAM test of the memory used by the workspace passed, the rest of the 
memory in the target system can now be tested at full bus speed. 
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In the Diagnostic field, select Simple RAM Test — Single Pass. 
Select the Run on Target checkbox. 

In the Start Address field, enter 14000. 

In the End Address field, enter 20000000. 

In the Units field, select LONG. 

Click Run. 

Workbench displays the test result in the Output field. 


Oe Gr Roo he 


If the message Test Complete appears, then the diagnostic passed. 


If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 7.3.5 Bus Tests, p.34. 


7.3.2 Full RAM Tests 


A Full RAM test writes a “walking” 1 on each bit of RAM and reads it back. This 
is a very lengthy test and can detect bus configuration errors, typically on a new 
printed circuit board. 


This test sets and then clears each bit to try to locate memory defects bounded by 
the starting and ending addresses entered in the Start Address and End Address 
fields. If an error occurs, the test stops and the error type and address will be 
displayed in the Output field. 


NOTE: A complete Full RAM test would take several years to finish, so make sure 
you specify a very small region of memory to be tested. 


Full RAM tests are designed to check for cell disturbance and addressing 
problems. These tests perform the following actions: 


A Single Pass test will run the test only once. A Continuous test will repeat the test 
over the same address until you click Stop. 


1. Inthe Diagnostic field, select Simple RAM Test - Single Pass. 
2. Select the Run on Target checkbox. 

3. Inthe Start Address field, enter 14000. 

4. Inthe End Address field, enter 14100. 
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5. Inthe Units field, select LONG. 

6. Click Run. 

Workbench displays the test result in the Output field. 

If the message Test Complete appears, then the diagnostics passed. 


If the test fails, try re-seating the SDRAM module and repeat the test. If the test still 
fails, then run the Address Bus Test diagnostic and the Data Bus Test diagnostic 
to determine the cause of the failure. See 7.3.5 Bus Tests, p.34. 


7.3.3 CRC Calculation 


Workbench and the emulator support the calculation of a Cyclic Redundancy 
Check (CRC) on all addresses in the range specified. The CRC test will checksum 
a block of data on the target for the address range you specify in the CRC 
Calculation dialog. The CRC algorithm is based on the following polynomial: 


x16 + x415 + x42+1 
Workbench uses this polynomial as follows: 


Workbench reads a location and uses the value read, x, to calculate the CRC. Then 
Workbench adds the result to the value calculated for the previous address. This 
process continues until Workbench has checked the entire specified memory 
range. 


The CRC sum will be returned if the communications with the emulator and target 
are working. To interrupt the test, click Stop. 


7.3.4 Scope Tests 


Read From Location 


The Read From Location Scope Test performs a memory read of designated length 
from the address entered in the From Address field. 


Write To Location 


The Write To Location Scope Test performs a memory write of designated length 
of the value entered in the Data Value field to the address in the To Address field. 
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Write and Complement 


The Write and Complement Scope Test performs a memory write of designated 
length of the value entered in the Data Value field to the address in the To Address 
field; the value is then complemented. 


Write Rotating Value 


Write Then Read 


The Write Rotating Value Scope Test performs a memory write of the value entered 
in the Data Value field to the address in the To Address field. The value is then 
rotated through all of the bit positions with respect to the designated length of the 
memory address. 


The Write and Read Scope Test performs a memory write of designated length of 
the value entered in the Data Value field to the address in the To Address field; the 
value is then read back. 


7.3.5 Bus Tests 


Address Bus Test 


Data Bus Test 


This test detects faults in the address bus over the range bounded by the starting 
and ending addresses entered in the Start Address and End Address fields. This 
test can be interrupted by clicking the Stop button. 


This test detects faults in the data bus over the range bounded by the starting and 
ending addresses entered in the Start Address and End Address fields. This test 
can be interrupted by clicking the Stop button. 


When you have tested your hardware successfully, you must test your ability to 
read and write memory, as described in 8. Testing Memory. 
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8.1 Introduction 


Before handling more complex application code, the target system must be able to 
handle low-level assembly instructions. 


Wind River Workbench includes a simple diagnostic to test the target’s ability to 
write to memory, set breakpoints, and run and step code. This diagnostic writes a 
loop of NOP instructions at a specified memory address. 


8.2 Testing Memory 


To run the memory diagnostic, use the following steps. 
1. At the >BKM> prompt in the OCD Command Shell, enter DF E 14000. 
This writes a NOP loop at address 0x14000. 


35 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


2. Enter the command DI 14000. 

This command disassembles the instructions at 0x14000. 
3. Enter the command SR PC 14000. 

This command sets the Program Counter to address 0x14000. 
The output should resemble that shown below. 


>BKM>d£ e 14000 
>BKM>di 14000 


$00014000 : 0x00000000 : nop 
$00014004 : 0x00000000 : nop 
$00014008 : 0x00000000 : nop 
$0001400C : 0x00000000 : nop 
$00014010 : Ox1OO0OFFFB : b 0x00014000 
$00014014 : 0x00000000 : nop 
$00014018 : 0x00000000 : nop 
$0001401C : 0x00000000 : nop 
$00014020 : 0x00000000 : nop 
$00014024 : 0x00000000 : nop 
$00014028 : 0x00000000 : nop 
$0001402c : 0x00000000 : nop 
$00014030 : 0x00000000 : nop 
$00014034 : 0x00000000 : nop 
$00014038 : 0x00000000 : nop 
$0001403C : 0x00000000 : nop 
$00014040 : 0x00000000 : nop 
$00014044 : 0x00000000 : nop 
$00014048 : 0x00000000 : nop 
$0001404C : 0x00000000 : nop 

>BKM>sr pe 14000 

>BKM> 

>BKM> 


Now there is a simple program in the target’s memory, and the Program Counter 
has been set to 0x14000. 


8.2.1 Stepping an Instruction 


First, test to see if the system can handle the step instruction command. 
In the Debug view, click the Step Into button. 


The Disassembly view opens, with the Program Counter now at 14004, as shown 
in Figure 8-1. 
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Figure 8-1 Disassembly View 


==" WRISS_4Ke 


System Context 

> 00014004: 
00014008: 
0001400c: 
00014010: ox14000 
00014014: 
00014018: 
0001401c: 
00014020: 
00014024: 
00014028: 
0001402c: 
00014030: 
00014034: 
00014038: 
0001403c: 
00014040: 
00014044: 
00014048: 
0001404c: 
00014050: 
00014054: 


Also, the System Context in the Debug view now reads 0x14004, as shown in 
Figure 8-2. 


Figure 8-2. System Context 


® Debug X 


Se I> aN DRAW MCBR 


=) $B WRISS_4Kkc [Attach to Target] 
= Pal 4Kc (System Mode} 
=) ay System Context (Stopped - Step End) 
aD 


0x14004 
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8.2.2 Running Code 


Next, test to see if the processor can run the simple program at full bus speed. 


In the Debug View, click the Resume button to start the target. In the Debug view, 
the System Context changes to Running, and a >RUN> prompt appears in the 
OCD Command Shell. 


Wait a few seconds and then click the Suspend button to stop the target. In the 
Debug view, the System Context changes to Stopped, as shown in Figure 8-3. 


Figure 8-3 System Context 


®. Debug X 
Oe NM R_eMBR 
oS &} WRISS_4Kc [Attach to Target] 


=) < 4Kc (System Mode} 
=) a System Context (Stopped) 


=" 


Also, the Disassembly view updates to show the new location of the Program 
Counter, as shown in Figure 8-4. 
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Figure 8-4 Program Counter at 14010 


=== WRISS_4Kc & 


System Context 
00014004: 
00014008: 
0001400c: 
00014010: Ox14000 
00014014: 
00014018: 
0001401c: 
00014020: 
00014024: 
00014028: 
0001402c: 
00014030: 
00014034: 
00014038: 
0001403c: 
00014040: 
00014044: 
00014048: 
0001404c: 
00014050: 
00014054: 


8.2.3 Setting Software Breakpoints 


Next, test to see if the target can set a software breakpoint. 


In the Disassembly view, double-click to the left of address 0x14018 (in the gutter.) 
Workbench places a software breakpoint at address 0x14020, as shown in 
Figure 8-5. 


39 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


Figure 8-5 Planted Software Breakpoint 


00014004: 
00014008: 
o0001400c: 
00014010: ox14000 
00014014: 

00014018: 
0001401c¢: 
00014020: 
00014024: 
00014028: 
o0001402e: 
00014030: 
00014034: 
00014038: 
0001403c: 
00014040: 
00014044: 
00014048: 
o0001404c: 
00014050: 
00014054: 


The breakpoint at address 0x14018 appears in the Breakpoints view. 


Figure 8-6 Breakpoints View 


‘Project I brn | Symbol B... 


s 0x14018 
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In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 


>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014018 [EVENT Taken] 
>BKM> 


This output shows that the software breakpoint at address 0x14018 has been hit. 
In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


Figure 8-7 System Context 


® Debug * 
Oe NM Re WMER 
| &} WRISS_4Kc [Attach to Target] 


oS ee 4Kc (System Mode} 
= a System Context (Stopped - Breakpoint Hit) 


i ox14018 


To remove the software breakpoint, double-click on the breakpoint icon to the left 
of address 0x14018 in the Disassembly view. 


8.2.4 Setting Hardware Breakpoints 


Next, test to see if the system can handle setting hardware breakpoints. 


In the Disassembly view, right-click to the left of address 0x1401C (in the gutter) 
and select Add Hardware Breakpoint. Workbench places an internal hardware 
breakpoint at address 0x1400C, as shown in Figure 8-8. 


41 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


Figure 8-8 Planted Hardware Breakpoint 


WRISS_4Kc 


System Context 
o0013ff4: 
o0013ff8: 
00013ffc: 
00014000: 
00014004: 
00014008: 
0001400c: 
00014010: ox14000 
00014014: 
00014018: 
0001401c: 
00014020: 
00014024: 
00014028: 
0001402c: 
00014030: 
00014034: 
00014038: 
0001403c: 
00014040: 
00014044: 


The hardware breakpoint at address 0x1400C appears in the Breakpoints view. 
Figure 8-9 Breakpoints View -- Hardware Breakpoint 


‘Project PSR = Breakpoints Local Yar...) — G 
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In the Debug view, click the Resume button to start the processor. The program 
will run until it hits the breakpoint. Output appears in the OCD Command Shell, 
showing that the system has stopped and showing the current location of the 
Program Counter, as shown below: 

>RUN> 

!BREAK! - [msg11001] Internal hardware breakpoint; PC = 0x0001401c [EVENT 
Taken] 

>BKM> 


This output shows that the hardware breakpoint at address 0x1401C has been hit. 


In the Debug view, the System Context changes to Stopped -- Breakpoint Hit. 


To remove the hardware breakpoint, double-click on the breakpoint icon to the left 
of address 0x1401C in the Disassembly view. 


If all these steps perform successfully, the target can run and debug low-level 
assembly code. The next step is to run and debug application code, as described in 
9. Debugging in RAM. 
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9.1 Overview 


This chapter describes the process of running and debugging application code in 
RAM using Wind River Workbench. 


9.2 Creating a Target Connection 


To download and run code and symbol information, you must have an active 
target connection. 
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To create a target connection, create projects, and download code, you can use a 
Wind River Probe, a Wind River ICE SX, or the Wind River Instruction Set 
Simulator (ISS), which is available to all users of Wind River Workbench OCD 
Edition. 


To create a target connection, use the procedure described in 4. OCD Connections. 


9.3 Creating a Project 


In order to download and run code and symbol information in RAM, you must 
have an active project open. 


Several example projects are included in Wind River Workbench for 
demonstration purposes. To open a new demonstration project, use the following 
steps: 


1. Select File > New > Example. 


The New Example wizard appears, as shown in Figure 9-1. 


46 


9 Debugging in RAM 
9.3 Creating a Project 


Figure 9-1 New Example Wizard 


% New Example 


Select a wizard 


Creates a new O5S-agnostic sample project 


Wizards; 


=| & Examples 
(0% Embedded Linux Sample Project 
(9 Native Sample Project 
a 
\R@ VxWorks Downloadable Kernel Module Sample Project 
{P% VxWorks Real Time Process Sample Project 
(8 Wind River Linux Sample Project 


Cancel 


2. Select Standalone Sample Project and click Next. 


A sample project template appears, as shown in Figure 9-2. 


47 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


Figure 9-2 Sample Project Template 


% New Project Sample 


Sample Project Template 


Select a sample project template. 


Available Examples: Information: 


C Demonstration Program C Demonstration Program 
1C++ Demonstration Program This program demonstrates various C 


1S The Ball Demonstration Program language features including structures, 


(The Panel Demonstration Program character arrays, linked lists, and recursion. 


You can build and download this program 
to your simulator or target board, The 
default RAM location for the program is 
0x00014000, To change the default 
memory address, edit the simple. lk linker 
command File, 


Features 
The Following Features are demonstrated 


3. Select C Demonstration Program and click Finish. 


Workbench creates the sample project in the default workspace directory, and 
the project name c_demo_sa appears in the Project Navigator view. 


4. Inthe Project Navigator view, expand the c_demo_sa project. 


A number of available build specs appear. 
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Figure 9-3 c_demo_sa 


@ arm-0x00000000-LE-diab_DEBUG 
@ arM-0x04000000-BE-diab_DEBUG 
@ arM-0x04000000-LE-diab_DEBUG 
 @Y ARM-0x08000000-BE-diab_DEBLIG 
@2 aRM-0x08000000-LE-diab_DEBUG 
t# @ McF-0x00000000-BE-diab_DEBUG 
@ mcF-0x20000000-BE-diab_DEBUG 
(29 mcF-0x40000000-BE-diab_DEBUG 
(29 mips32-4KEc-BE-16bit-diab_DEBUG 
(29 mips32-4KEc-BE-32bit-diab_DEBUG 
(29 mIpS32-4KEc-LE-16bit-diab_DEBUG 
(29 MIPS32-4KEc-LE-32bit-diab_DEBUG 
te (28 MIPS32-4Kx-BE-32bit-diab_DEBUG 
tH) G2 MIPS32-4Kx-LE-32bit-diab_DEBUG 
4) @22 MIPS32-BCM-BE-32bit-diab_DEBUG 
(4) G29 MIPS32-BCM-LE-32bit-diab_DEBUG 
(4) 22 MIPS32-IDT-BE-32bit-diab_DEBUG 
4-29 MIPS32-IDT-LE-32bit-diab_DEBUG 
(4-29 MIPS32-PHI-BE-32bit-diab_DEBUG 
(4-22 MIPS32-PHI-LE-32bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-16bit-diab_DEBUG 
tH GY MIPS32-PNX-BE-32bit-diab_DEBUG 
(29 mips32-PNX-LE-16bit-diab_DEBUG 
(2? mIPS32-PNX-LE-32bit-diab_DEBUG 
(29 mips32-WISS-BE-32bit-diab_DEBUG 
(29 mips32-WISS-LE-32bit-diab_DEBUG 
(29 mipsé64-20Kc-BE-diab_DEBUG 
(29 mIps64-20Kc-LE-diab_DEBUG 
(29 mIps64-Skc-BE-diab_DEBUG 
(29 mIps64-Skc-LE-diab_DEBUG 
(29 mipsé4-RM9000_P0-BE-diab_DEBUG 
(29 mipsé4-RM9000_PO-LE-diab_DEBUG 
(29 mipsé4-RM9000_P1-BE-diab_DEBUG 
(29 mipsé4-RM9000_P1-LE-diab_DEBUG 
(29 mipsé4-RM9000-BE-diab_DEBUG 
(2 MIPS64-RM9000-LE-diab_DEBUG 
(22 mIPS64-1X49-BE-diab_DEBUG 
(29 mips64-1%49-LE-diab_DEBUG 
(29 mips64-VR4131-BE-diab_DEBUG 
(29 mips64-VR4131-LE-diab_DEBUG 


2-2-2 oe ee ee 


5. To build the sample project, right-click on the c_demo_sa top-level folder and 
select Build Options > Set Active Build Spec. 


The Set Active Build Spec and Debug Mode dialog appears, as shown in 
Figure 9-4. 
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W Set Active Build Spec and Debug Mode 


PPC603diab-WISS 
MIPS32-4KEc-BE-16bit-diab 
MIPS32-4KEc-LE-16bit-diab 
MIPS32-4KEc-BE-32bit-diab 
MIPS32-4KEc-LE-32bit-diab 
MIPS32-4Kx-BE-32bit-diab 
MIPS32-4Kx-LE-32bit-diab 
MIPS32-BCM-BE-32bit-diab 
MIPS32-BCM-LE-32bit-diab 
MIPS32-IDT-BE-32bit-diab 
MIPS32-IDT-LE-32bit-diab 
MIPS32-PHI-BE-32bit-diab 
MIPS32-PHI-LE-32bit-diab 
MIPS32-PNX-BE- 1 6bit-diab 
MIPS32-PNX-LE-16bit-diab 
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Debug mode (use debug mode Flags) 


8. 
9. 


Select the build spec for your target family. This document uses the MIPS 4kc 
for its examples, so Figure 9-4 shows the MIPS build spec. 


Select Debug mode (use debug mode flags) so Workbench will generate 


symbolic debug information. 


Click OK. 


Right-click on the c_demo_sa folder and select Build Project. 


Workbench builds the sample project using the Wind River Compiler. The results 
of the project build appear in the Build Console view, as shown in Figure 9-5. 
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Figure 9-5 Build Console View 


Tasks Problems Properties [BIOs fs \etpgrm(-1e: Terminal 0 ec 


echo "building MIPS32-4KEc-LE-16bit-diab_DEBUG/date.o";dec -g -Xdebug-dwarf2 -tMIPS16LN:simple -DTOOL_FAMILY=dial & 
PS32-4KEc-LE-16bit-diab_DEBUG/date.o" -c "date.c" a 
building MIPS32-4KEc-LE-16bit-diab_DEBUG/date.o 

echo "building MIPS32-4KEc-LE-16bit-diab_DEBUG/math.o";dec -g -Xdebug-dwarf2 -EMIPS16LN:simple -DTOOL_FAMILY=dia 
P532-4KEc-LE-16bit-diab_DEBUG/math.o" -c "math.c" 

building MIPS32-4KEc-LE-16bit-diab_DEBUG/math.o 

echo "building MIPS32-4KEc-LE-16bit-diab_DEBUG/addone.o";das -tR4000LN:simple -DTOOL_FAMIL¥=diab -DTOOL=diab -L 
b_DEBUG/addone.o" “addone.s" 

building MIPS32-4KEc-LE-16bit-diab_DEBUG/addone.o 

echo "building MIPS32-4KEc-LE-16bit-diab_DEBUG/cdemo.elF"; did -o "MIPS32-4KEc-LE-16bit-diab_DEBUG/cdemo.elF" -tR401 
G/diabasm.o MIPS32-4KEc-LE-1 6bit-diab_DEBUG/cdemo.o MIPS32-4KEc-LE-16bit-diab_DEBUG/strutils.o MIPS32-4KEc-LE-1€ 
t-diab_DEBUG/linklist.o MIPS32-4KEc-LE-16bit-diab_DEBUG/date.o MIPS32-4KEc-LE-16bit-diab_DEBUG/math.o MIPS32-4KEc 
lity"; plink MIPS32-4KEc-LE-16bit-diab_DEBUG/cdemo. elf; Fi = 
building MIPS32-4KEc-LE-16bit-diab_DEBUG/cdemo.elf 

make: built targets of C:/WindRiver/workspace/c_demo_sa 

Build Finished in Project 'c_demo_sa’: 2006-09-25 15:10:39 (Elapsed Time: 00:08) 


NOTE: When using projects other than the supplied demonstration projects: you 
must compile your programs using debugging symbols (the -g compiler option) to 
use most debugger features. The compiler settings used by the Wind River 
Workbench project facility’s Managed Builds include debugging symbols. 


However, Workbench does not support code compiled with -02 optimization. 


9.4 Downloading Code and Symbol Information 


To run the sample code, right-click on cdemo.elf in the Project Navigator view and 
select Reset and Download. 


The Reset and Download view appears, as shown in Figure 9-6. 
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Figure 9-7 
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Reset and Download 


% WRISS_4Kc - 4Kc 


Modify attributes and launch. 


Name: | pWRISS_4Kc - 4Kc 


Main Wag Reset | ed Download | @ Instruction Pointer @# Run Options ** Projects to Build | ky Source | | Common | 


Connection 


Connection to use: | WRISS_4Kc (localhost) y) [Hide unconnected 


Connect WRISS_4Kc - WRISS_4Kc is connected. 


When opened from this folder, the Reset and Download view is pre-configured for 
this project. 


Leave the settings at their defaults and click Debug. 


The OCD Console view opens, as shown in Figure 9-7. 


OCD Console 


Local Variables Watch | Registers OCD Console X = a) 


Testing connection with core registers Passed 

Attempting to restore CPU context....... . Passed 
C:\WindRiver\workspace\c_demo sa\MIPS32- -4KEc-LE-16bit-diab _ DEBUG cdemo. elf 
Loading symbols... Completed at Default ¢ 
Specified not to Run 

* Reset and Download Completed * 


52 


9 Debugging in RAM 
9.4 Downloading Code and Symbol Information 


The OCD Console view shows the progress of the download operation, as 
Workbench downloads the sample code to the target. 


The Editor opens showing the Program Counter set at the beginning of the 
application code, as shown in Figure 9-8. 


Figure 9-8 Editor 


-ifdef PowerPC “a 
DTT TATAETEHKHEKEH EERE KETETEHK ETRE EEEEREKETETEKEREEEEEERER EERE RERERE 


-section = .text,,Cc 


-globl _Start, START, ENTRY 
-extern main 


> [ addis rii,cO,_ SP_INIT@ha # Initial Stack Pointer 
addi ri,ri1,_SP_INIT@1 


addis r13,c0, SDA_BASE @ha # Small Data area 
addi r13,c13, SDA_BASE @1 


addis r2,rI,_SDA2_BaSE @ha # Small Data Area 2 


addi r2,r2,_SDA2_ BASE @1 
addi r0,rJ3,0 # Push O onto stack 
stwu r0,-64(r1) 
ke 
bl main 
ck 
deadloop: 


b deadloop 


-globl addone 


a 
lv 
I< 


You are now ready to run and debug the application. 


53 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


9.5 Debugging Code in RAM 


Figure 9-9 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 


Debug View 


© Debug X 


oe Wi 28 ek B 
= &} WRISS_4Kc [Attach to Target] 
= < 4Kc (System Mode) 
S ay System Context (Stopped) 
=O 


__start() - diabasm.s:128 


9.5.1 Monitoring Processes 


When you start processes under debugger control, or attach the debugger to 
running processes, they appear in the Debug view labeled with unique colors and 
numbers. You can change the color assigned to a process or thread by right-clicking 
the process or thread and selecting Color > specific color. 


9.5.2 Stepping Through Code 


The Editor shows the source file diabasm.s, showing the c_demo_sa project’s 
initialization assembly. 


In the Debug view, click the Step Into button. 


The Program Counter moves to the second assembly instruction. If you open the 
Memoty view or the Registers view, you can see them update memory and 
register values as you step through instructions. 


Click the Step Into button seven more times, to step through all the initialization 
code and reach the first branch instruction: 


bl main 
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This is where the application branches out of assembly into C code. 
Click the Step Into button again. 


The application branches into main() and the Editor opens the source file cdemo.c, 
as shown in Figure 9-10. 


Figure 9-10 C Source 


| \al diabasm.s (@ cdemo.c X 


int wait_count, wait_index; 
int initval; f* initialization value for calculati 
char *globalstring[3] ; /* Uninitializeded array of string po 


char bell[2] = {BELL_CHAR, '\0'}; 


DL AAAAA RAAT KATA AAA ATTA AAA ATTA TATA TATA TATA ATTA AAA TATA AAA ATTA AT TT 
int main() 
{ 
| volatile long demo counter; 
volatile int pfa_demo=0; 
int sum = 0; 
volatile char cvar; /* sample char variable */ 
REC_TYPE1 q: 7 
volatile int localInti; 
volatile long localLongi; 


/* Setup the global string array */ 
globalstring[0) = "zero"; 
globalstring[1] = "one"; 
globalstring[2] = "two"; 


/* Initialize the rectest structure */ 
rectest.long integer = OxFFFFEEEE; 
rectest.short_integer = 5555; 
rectest.integer_array[0] = 0; 
rectest.integer_array[1] = 10; 
rectest.integer array[2] 20; 
rectest.inteqer array[3] 30; 
Ui 


9.5.3 Setting a Software Breakpoint 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. For a full explanation of Workbench breakpoints, 
see B. Internal Breakpoint Capabilities. 


In the left ruler of the Editor (the gutter), double-click to the left of the source line 


globalstring[2] = “two”; 
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This sets a software breakpoint on that source line. The breakpoint appears in the 
Breakpoints view. 


Figure 9-11 Planted Software Breakpoint 


“« Breakpoints % 


fom fc_demo_sajcdemo.c:113 (Restricted Scope) 


In the Debug view, click the Resume button. The program runs until it hits the 
breakpoint. The System Context changes to Stopped -- Breakpoint Hit. 


Breakpoint information also appears in the OCD Command Shell: 
>RUN> 


!BREAK! - [msg12000] Software breakpoint; PC = 0x00014074 [EVENT Taken] 
>BKM> 


9.5.4 Running a Program 


To run your downloaded program, click Resume in the Debug view. The program 
will run until it hits a breakpoint. If there are no breakpoints or interrupts, the 
program will run to completion or until you click Suspend. 


When the program is running, the System Context changes to Running, and a 
>RUN> prompt appears in the OCD Command Shell. 


If there are no breakpoints, you can stop the program by clicking the Suspend 
button in the Debug view or by entering the HA command at the >RUN> prompt 
in the OCD Command Shell. 


The Editor updates to show the current location of the Program Counter and the 
System Context in the Debug view changes to Stopped -- User Request. 
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9.5.5 Stepping Through a Program 


To single-step without going into other subroutines, click Step Over instead of 
Step Into. 


While stepping through a program, you may conclude that the problem you are 
interested in lies in the current subroutine’s caller, rather than at the stack level 
where your process is suspended. In this situation, if you click Step Return, 
execution continues until the current subroutine completes, then the debugger 
regains control in the calling statement. 


9.5.6 Setting a Hardware Breakpoint 


The availability of hardware breakpoints varies by architecture. You can only set 
as many hardware breakpoints as there are debug registers available on your 
target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 
Breakpoint Capabilities. 


In the Breakpoints view, click on the Menu button and select Add Data 
Breakpoint. 


The Data Breakpoint dialog appears. 
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Figure 9-12 Data Breakpoint Dialog 


®%, Data Breakpoint Properties 


Breakpoint Address and General Attributes 
ie Please specify Address Expression 


Select debug target for target-specific information 
| 4Kc 
None - preserve current settings 


) General Status Scope As Hardware 


Address Expression | 


[_] Continue on Break 


Continue Delay (ms) | | 


If an error message appears, you may have exceeded the number of allowed 
hardware breakpoints (four for most targets). Right-click in the Breakpoints view 
and select Remove All. Then select Menu > Add Data Breakpoint again. 


If an error message still appears, your target may not support hardware 
breakpoints. 


You can use data hardware breakpoints to find out which routines are modifying 
a specific variable. 


The Address Expression can be a symbol or a specific address in hex. You can use 
the address 0x0 in the Address Expression field to set a data hardware breakpoint 
to catch null pointers. You can set the Address Expression field to an address in 
the stack area to set a data hardware breakpoint to find out if the stack grew to that 
point. 


The following example sets a symbol in the Address Expression field. 
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1. Click Browse. 
The Select Symbol dialog appears, showing a list of available symbols that can 
take a hardware breakpoint. 


Figure 9-13 Select Symbol 


W Select a symbol 


Choose the symbol from the list. Debug symbols can only be 
retrieved if there is an active debug session 


Debug target 


| a 4ke 


Filter (regular expression) 


Matching symbols 


| @ abs - globalfunction 
abs - globalfunction 
abs - globalfunction 
addCell - globalfunction 
addCell - globalfunction 
addCell - globalfunction 
bell - globalyariable 

bell - globalyariable 

bell - globalyariable 
calendar - globalfunction 
calendar - globalfunction 
calendar - globalfunction 
cell_1 - dlobalvariable 


2. Scroll down and highlight the symbol wait_index. 
3. Click OK. 


The global variable wait_index is now the address for the data hardware 
breakpoint. 


The hardware breakpoint on wait_index appears in the Breakpoints view. 
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Figure 9-14 wait_index 


“« Breakpoints * 


In the Debug view, click Resume. 


The program runs until it hits the hardware breakpoint. Workbench halts the 
processor when it locates wait_index and displays that source line in the Editor. 
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Figure 9-15 Hardware Breakpoint Hit 


i) e >». oO 
cc) cdemo,c 23 (c) strutils.c Id calendar.c 3 = 


globalLongl = calendar({ localLongl j; 


® iQ 
q.a = 55; 
strepy (q.b, "December"’) ; 
q.c = 12345678L; 


q.-color = red; 
sur = 0: 

» wait_index = 0; 
wait count = 5; 


quick index La 


recordvar.color = red; 


bh ft] 
while (wait_index < wait count) 
{ 
wait _index = addone(wait_index)- 


€ | 


|< 


| 


9.5.7 Disconnecting and Terminating Processes 


Disconnecting from a process or core detaches the debugger, but leaves the process 
or core in its current state. 
Terminating a process actually kills the process on the target. 


NOTE: If the selected target supports terminating individual threads, you can 
select a thread and terminate only that thread. 
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Programming Flash Memory 


10.1 Introduction 63 

10.2 Testing Flash Workspace 64 

10.3 Getting Started 65 

10.4 Flash Configuration Tab 66 

10.5 Flash Programming Tab 69 

10.6 Flash Memory/Diagnostics Tab 74 


10.1 Introduction 


In order to erase and program target flash memory, you must first set up your 
target registers properly, as described in 6. Board Initialization. 


The Flash Programmer view provides the ability to flash images into flash chips 
present on your target. 


To program flash correctly you need to know the physical characteristics of your 
flash bank. For instance, your target may have one flash device connected to a 
64-bit bus. Or it may have a bank of several flash devices, for example two flash 
devices, each wired at 16 bits, connected along a 32-bit bus. If you are using a Wind 
River-supported target, this information can be found in the file 


installDirlvxworks-6.x/target/config/yourTarget/target.ref 
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If you are not using a Wind River-supported target, consult your target’s 
documentation. The design primitives of your target board should be included in 
its board specification and schematics. 


10.2 Testing Flash Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download, and breakpoints, which are 
used to stop an erase and program operation at completion. 


Reading and Writing Memory 


Once you have established communications with the target, use the following 
procedure to make sure you can write to and read from the target. In this example 
we assume that the RAM workspace is 0x00F00200. 


NOTE: A RAM workspace address of 0x00F00200 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your target’s target.ref file, located in 
installDir/vxworks-6.x/target/config/yourTarget/target.ref. 


Wherever the RAM workspace is located on your target, you must make sure that 
memory is writable there. 


At the >BKM> prompt, enter dm 00F00200 and press ENTER. Doing so displays the 
memory on your target at address 0. 


Next, enter sm 00F00200 1234 and press ENTER to set the memory at address 0 to 
the value 1234. Enter dm 00F00200 to display the memory at that address again. 


If you are communicating properly with your target, output is similar to that 
shown below: 


>BKM>dm 00£00200 

OOFO0200: FF7C EFFE FEFF E3FE 0D01 OFBE FOFD BFB6 . | sah aclornat Si eth ta arses atse Se 
>BKM>sm 00£00200 1234 

>BKM>dm 00£00200 

OOFO0200: 1234 EFFE FEFF E3FE O0D01 OFBE FOFD BFB6 .4............. 
>BKM> 
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Occasionally, you may have difficulty programming flash memory on your target 
if software breakpoints are not being hit properly. Test this functionality before you 
continue. 


To use the test, enter the following commands at the >BKM> prompt in the OCD 
Command Shell: 


>BKM>df e 0 


>BKM>di 0 6 


$00000000 : 0x60000000 : nop 
$00000004 : 0x60000000 : nop 
$00000008 : 0x60000000 : nop 
$0000000C : 0x60000000 : nop 
$00000010 : Ox7COOO4AC : sync 
$00000014 : Ox4BFFFFFO : b 0x4 
>BKM>go 0 
>RUN>dr pe 
PC = 00000004 
>RUN>dr pe 
PC = 00000010 
>RUN>sb 8 
>RUN> 
!BREAK! - [msg12000] Software breakpoint; PC = 0x00000008 [EVENT Taken] 
>BKM> 
>BKM>rb 
>BKM> 


10.3 Getting Started 


Once you have connected to Wind River Workbench, as described in your 
emulator’s Hardware Reference, and configured your target registers, as described 
in 6. Board Initialization, you are ready to begin programming flash. 


1. Inthe toolbar, click on Window, then select Show View > Flash Programmer. 
The Flash Programmer view appears. 


The Flash Programmer view has three tabs: Configuration, Programming, and 
Memory/Diagnostics. Use these tabs to configure your flash address and RAM 
workspace, choose files for download, execute erase and program operations, and 
check the results of your operations. 
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10.4 Flash Configuration Tab 


Use the Configuration tab to configure the base address and workspace address 
for flash memory erase operations . You can also enter the physical description of 
your flash devices. 


Figure 10-1 Configuration Tab 


Error Log Tasks Problems Properties Build Console OCD Command Shell eQNsrenispes iui ated Terminal 0 


Configuration Programming | Memory/Diagnostics 
Device Selection Configuration 
Current: Flash Bank Addresses 
Base: | Oxe0000000 | Last: 


| = aMD 


w 29LVO04T RAM Workspace 
fH 29LY004B 


H 29LVOOBBT | start: | ox00F00200 | End: 


(# 29LYO08BB Size: 392 —SOtC«C 

(4) 29F010 

- 29F040 

(=. 29F080/81 

(=) 1024x 8 

1 Device 
2 Devices 
SetjEdit Timeouts 
8 Devices Program: 

(#) 29F016/17 

 29F032/33 


Erase: 


10.4.1 Selecting a Flash Driver 


In the Device Selection field, browse to a description of your flash bank. 
Figure 10-1 shows an example of a flash bank consisting of four 8-bit AMD 29F0808 
devices. 


NOTE: For AMD flash devices, “F” and “LV” devices are interchangeable in 
Workbench. 


If you attempt to move on to the Programming tab without selecting a flash bank 
description in the Configuration tab, Workbench displays an Invalid Flash Bank 
error and returns you to the Configuration tab. 
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10.4.2 Configuring Flash Memory Bounds 


In the Configuration field, enter the Base value for the area of flash memory you 
wish to erase. In Figure 10-1 the address used is 0xe0000000. The Last field 
populates automatically. 


NOTE: Workbench erases flash memory sector by sector. That means that no matter 
where the address you enter in the Base field is located within the flash sector, 
Workbench will still erase the entire sector. 


If Workbench detects that the address you entered in the Base field is not correctly 
aligned with the flash sector boundary, it displays the following warning message: 


Figure 10-2 Incorrect Flash Base Address 


WARNING - Incorrect Flash Base Address 


A Incorrect address: OxFFFFFFFF 


The base address you entered For your Flash is incorrect. 
This address must be aligned on a boundary of 0x100000 


Clicking ‘Align’ will align your Flash base address correctly For you, 
Clicking ‘Cancel will take you back to the configuration tab so that you can re-enter the base address manually. 


Clicking ‘Continue’ will allow you to use the incorrectly aligned address that you have entered. 
Be aware that this option could cause undetermined behavior while using the Flash utility and is not recommended. 


Continue Cancel 


* To have Workbench align your base address, click Align. Workbench aligns the 
base address with the nearest preceding sector boundary. 


* To go back to the Configuration tab and re-enter the address manually, click 
Cancel. 


* To use the base address as you entered it, without aligning it with the flash 
boundary, click Continue. 
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uN CAUTION: Choosing Continue may cause unpredictable results in your flash 
programming operations. Wind River recommends that you align the base 
address with the flash sector boundary. 


10.4.3 Configuring Flash Memory Bounds 


In the Configuration field, enter the Base value for the area of flash memory you 
wish to erase. In Figure 10-1 the address used is 0xe0000000. The Last field 
populates automatically. 


NOTE: Workbench erases flash memory sector by sector. That means that no matter 
where the address you enter in the Base field is located within the flash sector, 
Workbench will still erase the entire sector. 


10.4.4 Configuring RAM Workspace 


The flash programming algorithm needs to run on the target. This requires a RAM 
workspace, to which the algorithm will download. 


In the RAM Workspace field, enter the Start value for the area of RAM you wish 
to use as the workspace. In the Size field, enter the desired size of the workspace 
in bytes. In Figure 10-1 the starting address used is 0x00F00200 and the workspace 
size is 3992. The End field populates automatically. 


NOTE: A RAM workspace address of 0x00000000 is not appropriate for all targets. 
For Wind River-supported targets, you can find the necessary RAM workspace in 
your processor’s target.ref file, located in 
installDir/vxworks-6.x/target/config/yourTargetBoard/target.ref, or target.ref.linux 
file, located at http://www.windriver.com/support. 


10.4.5 Setting Timeouts 
To set a program or erase timeout, use the Program or Erase fields in the Set/Edit 


Timeouts area. Enter a timeout value in seconds. If you enter an invalid number, 
Workbench resets the timeout to its default setting. 
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10.5 Flash Programming Tab 


Figure 10-3 


Use the Programming tab to execute erase and program operations in flash and to 
specify files for download. 


Programming Tab 


Error Log | Tasks Problems Properties Build Console OCD Command Shell WaQiisesntar lyme ata’ Terminal 0 
Configuration | Programming | Memory/Diagnostics | 


Flash Programming Erase Sector Selection 
[_]Send "IN" before each operation 


[Enable pre-Flash | 
[Enable post-flash | 


Erase Program Erase/Program Verify Abort 


(J Override erase sector selection 


+ 


Sector 

Oxe0000000 
Oxe0040000 
Oxe0080000 
Oxe00c0000 
Oxe0100000 
Oxe0140000 
Oxe0180000 
Oxe01c0000 
Lower boundary address [oxeno00000 | pisahacphte 
Upper boundary address [ | Oxe0280000 
Oxe02c0000 
Oxe0300000 
Oxe0340000 
Oxe0380000 
Oxe03c0000 


Select all Clear all 


WOUYANHEWONHKO 


Add/Remove Files 


Status File Path Start Addr... End Address Enabled 


10.5.1 Erasing and Programming Flash 


To issue an IN initialization command before erase or program operations, select 
the Send “IN” before each operation checkbox. 


Click Erase to erase the contents of the flash memory sectors you selected in the 
Configuration tab. 


Click Program to program the flash memory with the files you selected in the 
Add/Remove Files area of the Programming tab. 


Click Erase/Program to perform both operations. Workbench will erase all selected 
flash sectors before programming. 


Click Abort to stop the erase or program operation. 
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10.5.2 Verifying Flash Contents 


Click Verify to execute a byte-by-byte comparison between the file you just 
downloaded and the file already in memory. If there is a discrepancy, Workbench 
will break at that address and deliver an error message. 


10.5.3 Running a Pre- or Post-Flash Script 


You can specify a script to run before or after an erase or program operation. Select 
the Enable pre-flash or Enable post-flash checkboxes (you can select either or 
both for any operation). Next to the checkbox, click Browse and navigate to the 
script you wish to run. 


10.5.4 Selecting Flash Sectors for Erasure 


The Sectors field automatically populates with the starting addresses of sectors of 
flash memory, depending on which flash device you specified in the 
Configuration tab. Click on a sector to select it. You can select all sectors by 
clicking Select All . Click Clear All to deselect all sectors. 


Before you erase all sectors, make sure you know what resides in the flash. For 
example, if your processor reads the reset configuration word out of the flash 
device, erasing the entire device may cause problems with resetting the board. 


10.5.5 Manually Configuring Flash Memory Erasure Bounds 


Workbench allows greater user control by allowing manual configuration of the 
flash memory bounds for erase operations. 


You can manually configure the flash memory bounds by checking the Override 

erase sector selection checkbox. When this box is checked, Workbench will allow 
you to enter any addresses in the Lower boundary address and Upper boundary 
address fields. 


NOTE: If the values you enter result in a memory address range that is outside 
your target board’s flash programming area, erase operations will not perform 
correctly. 
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10.5.6 Adding Files 


To add a .bin file, click Add File. This opens the Choose File for Flash Download 
browser window. Workbench automatically looks for a folder labeled firmware, 
located in installDir!workbench-2.x/dfw/version/host/firmware, where version is 
the installed version of the debugger middleware. If your .bin files are stored in 
another folder, use the browser to navigate to it. Select the file you want and click 
Open. The file will appear in the File Path field. 


10.5.7 Removing Files 


To remove a file from the list, highlight it and then click Remove File. 


10.5.8 Converting Files To Wind River Flash Binary Format 


In order to use a file to program flash, you must convert it to a Wind River binary 
format that the Flash Programmer can use. Workbench can convert any of the 
following file types to Wind River binary format: 


« elf files 

« hex files 

« — srec files 

«any headerless flat binary (RAWBIN) file 


To convert a file to Wind River binary format, use the following steps: 
1. Inthe Programming tab, select Convert File. 


2. Inthe browser window that opens, navigate to the file you want to convert and 
click Open. 


The Convert utility appears. 
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File Conversion utility 


File path 
Input path: [ C:\bitbucket\cdemo.elF (J This is a raw binary file 
Output path: | c:\bitbucket\cdemo.bin 


Conversion output 
Address information 


Start: | oxooo00000 | 
End: | oxfffFFFFr 


Convert File 
Convert and Add File 


Converting the file to Wind River binary format does not delete the original 
file. 


By default, Workbench stores the new binary file in the same location as the 
original file. If you want the new binary file stored somewhere else, enter the 
path to the desired location in the Output path field. 


3. Select Convert and Add File. 


Workbench converts the selected file to Wind River binary format and adds it 
to the file list in the Programming tab. 
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File Conversion utility 


File path 
Input path: | C:\bitbucket\cdemo.elF (J This is a raw binary file 
Output path: C:\bitbucket\cdemo.bin 


Conversion output 


Address information lconvert v7.11G Copyright (c) 1996-2006 Wind River HSI 
- convert ELF file C;:\bitbucket\cdemo.elF to Flat Binary file C:\bitbucket\cdemo.bin 
pest Ox00000000 Extracting image from 'C:\bitbucket\cdemo. elf 
End: | OxfffrFFFE ‘Writing flat binary image to 'C:\bitbucket\cdemo.bin' 
Lower address: 0x0 
|Upper address: OxfFFFFFFF 
‘Execution address: 0x00000400 
Image written 
Processing time: 0,000 seconds 


Convert File 
Convert and Add File 


NOTE: To convert the selected file to Wind River binary format without adding 
it to the file list in the Programming tab, select Convert File. 


4. Click OK. 


You are returned to the Programming tab. The file you just converted now 
appears in the File Path field. 


10.5.9 Setting The Download Offset Of A File 


In some cases, before you program the file into flash, you may need to set a 
memory offset bias to divert the data to other areas of the flash bank. 


Each file is built with a start address. This start address may or may not be the 
address where you want the image to reside on the board. If you subtract the start 
address of the image from the address where you want the image to reside on the 
board, then you end up with the proper bias address. 
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For example, if the image was built with a start address of 0x00 and you wanted 
the image to reside at the reset vector 0OxFFF00100, then the offset bias would be 
FFF00100. 


You can use the Add/Remove Files area to edit the starting address of a .bin file to 
offset the file into flash. Click on the value under the Start Address heading to 
highlight it. Edit the value as needed. 


10.5.10 Enabling A File For Download 
Enable a file by clicking on the checkbox under the Enabled heading. If the file 
address is outside your specified address range, an error message appears: 


Cannot enable for download. 
Part of this file falls outside your flash address range. 


To correct this error, you must either change the start address of your file or use the 
Configuration tab to change your flash address range. 


10.6 Flash Memory/Diagnostics Tab 


Use the Memory/Diagnostics tab to view the contents of flash memory and to run 
diagnostic tests to verify your ability to write and erase flash. 


You must set up the Configuration tab before using the Memory/Diagnostics tab. 
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Figure 10-4 Memory/Diagnostics Tab 


Programming | Add/Remove Files | Configuration Memory/Diagnostics | 


View address: | oxffrooooo Program | Erase | Abort 
jaddress  [o [1 [2 [3 [4 [5s [6 [7 [e Jo Ja [eB fc [> Je [r Jascrz = 


FFFOOO10 5B 44 75 6C 79 20 32 30 2C 20 32 30 30 30 20 SD [July 20, 26 
FFFOOO20 30 .32 32 33 °34 :35 36 37 936 .39 61: 62 63: .64 65 66 :0123456769en 
FFFOOO30 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 #74 75 76 ghijklmnopqr 
FFFOOO40 77° #78 #79 7k 21 40 23 24 25 SE 26 2A 28 29 SF 2B wxyz!@#$%* «; 
FFFOOOSO Fre -FE! (EE FF SEF CFF) CRF EF 2EE: cEF ER FF SEF: cf) GEE’ EF. 
FFFOOO60 oo oo OO OO OO OO OO OO OO OO OO lOO 600 hoo lOO lo 
FFFOOO70 4A 55 66 99 AA 5S 66 99 AA SS 66 99 AA S55 66 99 ut wut wut 
FFFOOOSsO AR 55 66 99 AA 55 66 99 AA 55 66 99 AA SS 66 99 UL “UL “UL 
FFFOOOSO AR 5S 66 99 -AA -55' 66 99 «AA «SS 66 99 ~AA 55 66; 99 ut wut wut 
FFFOOOAO AA SS 66 99 AA 5S 66 99 AA SS 66 99 AA 5S 66 99 ut Uf Ut 
FFFOOOBO AR 65506 66606« 99: AA CSS «(C66 «6999: |} 6AA SS (O66 C99: AA SS (C66 COD Ur UL Ut 


FFFoOOOCcCO 4h S55 66 99 AA 55 66 99 BA SS 66 99 AR SS 66 99 Ut Ut Uf 
FFFOOODO 4h 55 66 99 AA 55 66 99 BA S55 66 99 AA SS 66 99 Uf “Uf “Ut 
FFFOOOEO 4A 55 66 99 AA 5S 66 99 AA 5S 66 99 AA 55 66 99 UL “UL “UL 
FFFOOOFO aa 55 66 99 aA 55 66 99 AA’ SS 66 99 dA SS 66 99 UL “UL “UE 


~Messages 


——_ 


10.6.1 Viewing Memory 


Enter the address you wish to view in the View Address field. The area below 
displays the bit-level detail. To change the view, edit the address in the View 
Address field and click Refresh. You can also use the scrollbar on the right to scroll 
up and down from the starting address to the end address. 


10.6.2 Running Diagnostic Tests 
To test your ability to write to flash memory, click the Start Program Diagnostic 
button. This writes a bit pattern to flash. 
You may see a Target Exception message. This requires no action. 


If the write operation is successful, you should see the pattern *WRS_FLASH* 
repeated under the ASCII heading in the Memory/Diagnostics tab, as shown in 
Figure 10-5. 
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Figure 10-5 Successful Program Diagnostic 


Programming | Add/Remove Files | Configuration Memory/Diagnostics | 


View address: J oxffrooooo Refresh | Program | Erase | fe 


SF 46 4C 41 53 48 2A SF 248 57 S52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 48 2A SF 2A S? 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S7? S2 53 SF 46 4C 41 53 48 2A SF 24 5S? 52 53 *WRS_FLASH* *URS 
SF 46 4C 41 53 48 2A SF 2A 57 52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
S53 46 2A SF 2A S7 S52 S53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2k S57? S52 53 SF 46 4C 41 53 48 2A SF 24 S57? 52 53 *WRS_FLASH* *WRS 
SF 46 4C 41 53 48 2A SF 2A 57 S52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 46 2A SF 24 5S? 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S? S52 53 SF 46 4C 41 53 48 2A SF 248 S7? 52 53 *WRS_FLASH* *URS 
SF 46 4C 41 53 48 2A SF 2A 57 52 53 SF 46 4C 41 _FLASH* *WRS_FLA 
53 46 2A SF 24 57 52 53 SF 46 4C 41 53 48 2A SF SH*_*URS_FLASH*_ 
2k S57? 52 53 SF 46 4C 41 53 48 2A SF 2A 57? 52 53 *WRS_FLASH*_*URS 
SF 46 4C 41 53 486 2A SF 2A S7 S2 S53 SF 46 4C 41 _FLASH* *URS_FLA 
53 48 24 SF 2A S57 52 53 SF 46 4C 41 53 48 2A SF SH*_*WRS_FLASH*_ 
2k 57 52 53 SF 46 4C 41 53 48 2A SF 2A S57? 52 53 *WRS_FLASH*_*URS 


= 


So 


Messages 


If the write operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the write operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 


To test your ability to erase flash memory, click the Start Erase Diagnostic button. 
This will erase the selected flash sectors. 


You may see a Target Exception message. This requires no action. 


If the erase operation is successful, the selected sectors will be erased and the space 
under the ASCII heading in the Memory/Diagnostics view will be empty. 


If the erase operation is unsuccessful, the diagnostic will never complete. You will 
need to click the Abort Diagnostic button to stop the erase operation. Check to 
make sure that you have the right flash device selected in the Device Selection 
area in the Configuration tab, and that you are using the correct base address. 
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11.1 Overview 


The procedure described in 9. Debugging in RAM uses software breakpoints. 
Software breakpoints work by replacing the destination instruction with an 
interrupt; therefore it is impossible to debug code in ROM using software 
breakpoints. 


To debug code in ROM you must use hardware breakpoints, which work by setting 
a break condition and comparing the condition with the execution stream. This 
chapter describes using Workbench to debug code in ROM with hardware 
breakpoints. 
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11.2 Getting Started 


To debug code in ROM, you must have an active target connection. 


To create an active target connection, follow the steps described in 4. OCD 
Connections. 


NOTE: You cannot use the Instruction Set Simulator to simulate debugging in 
ROM, because you must have an actual target in order to set hardware 
breakpoints. 


You do not need to have an active project to debug code in ROM. 


11.3 Debugging in ROM 


Use the Debug view to monitor, control, and manipulate the processes and tasks 
that you are actively debugging. The Debug view shows only the processes that 
are currently under debugger control. 


1. Inthe Target Manager view, right-click on your target name and select Attach 
to Core. 


The Disassembly view opens, with the Program Counter set to the start of the 


reset vector. 


NOTE: The reset vector will vary between target processors. The example used in 
this chapter is only one of many possible examples. 
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System Context 

Y TETUVUIUU: 11 r3,2 a] 
ff£f00104: nop 
fff00108: bl OxFFFOO138 
fff0010c: bel Ox1E, OxF, OxFFFO%184 
££f00110: andi. r9,r19,Cx67€8 
f££f00114: andis. 1r0,r1,0x313¢ 
££f00118: addi ri,r20,Cx2D32 
fFffOOl11c: addic ri,ri6,Cx3220 
ff£f00120: elrelwi r9,r27,Cx26,0xD 
fff00124: subfic r2,r18,Cx6976 
fff00128: oris ri16,r11,0x2C53 = 
fff0012c: . long Ox?S737465 
ff£f00130: xoris r19,r11,0x2c20 
fff00134: ha Ox1€E632C 
fL£f00138: mr E11,r3 
££f0013e: “Or r4,r4,r4 
ff£f00140: mr rO,r4 
£££00144: isyre 
f£f00148: rmtmer r4 = 
ff£f0011c: ioyre 
£££00150: xor r0,r0,rC 
f£££00154: IULSEL spceveO,cc 
ff£f00156: mtspr sprei,rC 
rrroolse: mesrer sprez,rc 
ff£f00160: mtspr spre3,rC 
Irruv1b4: xor r4,r4,r4 
f££f£00168: mtsr o,r4 hd 


2. Inthe Target Manager view, select OCD Reset and Download. 
3. Select the Reset tab. 
4. Set the reset type to INN -- Reset. 
This will initialize the target, but leave the target registers as close to reset 


value as possible. 


NOTE: Because the target registers are not set, the target software watchdog 
timers are still active. This can cause some targets to drop out of background 
mode. 


5. Leave the Play register file box unchecked. 
6. Select the Download tab. 
7. Click Add Files... 
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Tasks Problems Properties Error Log | Terminal OCD Command Shell OCD Console * CF Options 3 


~ Reset and Download 


< 


In the browser window that appears, navigate to the boot ROM file for your 
target. 


If you are using a Wind River-supported target, the boot ROM file is located in 
installDirlvxworks-6.x/target/config/your_target. If you are supplying your 
own boot ROM file, navigate to the directory where it is located. 


Click Open. 
You are returned to the Download tab. 
Uncheck the Download checkbox. 


Make sure the Load Symbols checkbox is selected and the Verify field is set to 
None. 


Select the Instruction Pointer tab. 

Uncheck the Set instruction pointer after download checkbox. 
Select the Run Options tab. 

Make sure the Do not run checkbox is selected. 

Click Debug. 


The OCD Console view opens to show the results. 


Testing Communications to Hardware Interface... Passed 
Driving HRESET to be High Passed 
Driving HRESET to be Low Passed 
Waiting HRESET Low Acknowledge. i Passed 
Attempting JTAG communication. Passed 
Waiting For HReset to be released.. . Passed 
Testing for target STOP State Passed 
Comparing target CPU with CF setting er Passed 
Waiting For HRESET High Acknowledge... it Passed 
Testing JTAG Communication. ey Passed 
Testing JTAG Communication. ra Passed 
Getting value of cF mmu option .. Passed 
Attempting to restore CPU context Passed 
Loading symbols... 

C:\WindRiver\yxworks-6. 3\target\config\wrPpmc?50Fx\bootrom_uncmp Specified not to Download 
Specified not to Run 

* Reset and Download Completed * 
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11 Debugging in ROM 
11.3 Debugging in ROM 


11.3.1 Stepping Through Boot Code 


In this example, the first line of the reset vector is a Load Immediate command: 
f£££00100 li aes 

1. Inthe Debug view, click the Step Into button. 
The Program Counter moves to the No-Operation command on the next line: 
£££00104 nop 


In the Debug view, the System Context changes to Stopped -- Step End, and 
the view updates to show the new location of the Program Counter. 


If you have data views, such as the Watch view, Memory view, or Registers 
view open, you can see them update as you step through code. 


2. Inthe Debug view, click Step Into again. 


The Program Counter moves to the Branch and Link instruction on the next 
line: 


£££00108 bl OxFFF00138 
3. Inthe Debug view, click Step Into one more time. 


The branch instruction executes and the Program Counter jumps to address 
FFF00138. The Debug view updates to show the Program Counter at address 
FFF00138. 


11.3.2 Setting Hardware Breakpoints 


Breakpoints allow you to stop a running program at particular places in the code 
or when specific conditions exist. Use the Breakpoints view to keep track of your 
breakpoints and their conditions. 


To debug in ROM you must use hardware breakpoints. The availability of 
hardware breakpoints varies by architecture. You can only set as many hardware 
breakpoints as there are debug registers available on your target. 


Once a hardware breakpoint is trapped, the debugger will behave in the same way 
as for a standard breakpoint and stop for user interaction. 


For a full description of hardware breakpoints in Workbench, see B. Internal 
Breakpoint Capabilities. 


1. Inthe Disassembly view, right-click in the left ruler (the gutter) to the left of 
the Exclusive Or instruction at address FFFO0150: 
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£££00150 xor r0,r0,xr0 


From the context menu that appears, select Add Hardware Breakpoint. 


The breakpoint appears in the Disassembly view and is displayed in the 
Breakpoints view. 


In the Debug view, click the Resume button. 

The code runs until it hits the hardware breakpoint at address FFFO0150. 

In the Debug view, the System Context changes to Stopped --Breakpoint Hit. 
The following message appears in the OCD Command Shell: 


>RUN> 


!BREAK! - [msg11001] Internal hardware breakpoint; PC = Oxff£f£00150 [EVENT 
Taken] 

>BKM> 

To remove the hardware breakpoint, double-click on the breakpoint icon in the 
Disassembly view gutter, or right-click on the breakpoint in the Breakpoints 
view and select Remove. 


Pins Mapped to Common 
Signals 


A.1 Introduction 83 
A.2 MIPS Processors --JTAG 83 


A.1 Introduction 


This appendix describes mapped pins to common signals for Wind 
River-supported MIPS processor families. 


For all families described in this appendix, “n” is set as an ACTIVE LOW. 


A.2 MIPS Processors -- JTAG 


Table A-1 MIPS -- JTAG 


Pin 
Number Function Description 
1 nTRST Test Reset (reset JTAG clock) 
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MIPS -- JTAG 

Pin 

Number Function Description 

2 GND Ground 

3 TDI Test Data In 

4 GND Ground 

5 TDO Test Data Out 

6 GND Ground 

7 TMS Test Mode Select 

8 GND Ground 

9 TCK Test Clock 

10 GND Ground 

11 nRESET Processor Reset 

12 NC Not Connected 

13 DINT Debugger Interrupt 
14 JTAG_VIO JTAG Voltage Output 
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Internal Breakpoint 
Capabilities 


Emulators use breakpoints to implement single stepping, since the embedded 
processor’s single step mode, if it has one, is not useful for stepping through C 
code. 


Software breakpoints work by replacing the destination instruction by a software 
interrupt. Therefore, it is impossible to debug code in ROM using software 
breakpoints. 


Hardware breakpoints work by setting a break condition and comparing it against 
the execution stream. You can use hardware breakpoints to debug code in RAM, 
ROM, flash memory, or even unused address spaces. 


Complex breakpoints involve conditions. An example might be, “Break if the 
program writes value to variable if and only if function_name was called first.” A 
software-only debugger setting a complex breakpoint must interpret the program 
while watching for the trigger condition, which slows performance. Emulators 
implement complex breakpoints in hardware, so there is no performance penalty. 


In Wind River Workbench, you can use the Breakpoints view to keep track of all 
breakpoints, along with any conditions. 


You can create breakpoints in different ways: by double-clicking or right-clicking 
in the Editor’s left overview ruler (also known as the gutter), by opening the 
various breakpoint dialogs from the pull-down menu in the Breakpoints view 
itself, or by selecting one of the breakpoint options from the Run menu. 


Wind River Workbench supports three kinds of breakpoints: line breakpoints, 
expression breakpoints, and hardware breakpoints. 
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Line Breakpoints 


Set a line breakpoint to stop your program at a particular line of source code. 


To set a line breakpoint with an unrestricted scope (that will be hit by any process 
or task running on your target), double-click in the left gutter next to the line on 
which you want to set the breakpoint. A solid dot appears in the gutter, and the 
Breakpoints view displays the file and the line number of the breakpoint. You can 
also right-click in the gutter and select Add Global Line Breakpoint. 


To set a line breakpoint that is restricted to just one task or process, right-click in 
the Editor gutter and select Add Breakpoint for selected thread. If the selected 
thread has a color in the Debug view, a dot with the same color will appear in the 
Editor gutter, with the number of the thread inscribed inside it. 


Either of these actions opens the Line Breakpoint dialog, where you can create and 
adjust the properties of the breakpoint. 


Expression Breakpoints 


Set an expression breakpoint using any C expression that will evaluate to a 
memory address. This could be a function name, a function name plus a constant, 
a global variable, a line of assembly code, or just a memory address. Expression 
breakpoints appear in the Editor’s gutter only when you are connected to a task. 


Breakpoint conditions are evaluated after a breakpoint is triggered, in the context 
of the stopped task or process. Functions in the condition string are evaluated as 
addresses and are not executed. Other restrictions are similar to the C/C++ 
restrictions for calculating the address of a breakpoint using the Expression 
Breakpoint dialog. 


Select Add Expression Breakpoint from the pull-down menu in the Breakpoints 
view to open the Expression Breakpoint dialog, where you can create and adjust 
the properties for the breakpoint. 


Hardware Breakpoints 


Some processors provide specialized registers called debug registers that can be 
used to specify an area of memory to be monitored. For instance, [A-32 processors 
have four debug address registers, which can be used to set data breakpoints or 
control breakpoints. 
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B Internal Breakpoint Capabilities 


Hardware breakpoints are useful if you want to stop a process when a specific 
variable is written or read. For example, with hardware data breakpoints, a 
hardware trap is generated when a write or read occurs in a monitored area of 
memory. Hardware breakpoints are fast, but their availability is 
machine-dependent. On most CPUs that do support them, only four debug 
registers are provided, so you can only watch a maximum of four memory 
locations in this way. 


There are two types of hardware breakpoints: 
* A hardware data breakpoint occurs when a specific variable is read or written. 


« A hardware instruction breakpoint or code breakpoint occurs when a specific 
instruction is read for execution. 


Once a hardware breakpoint is trapped—either an instruction breakpoint or a data 
breakpoint—the debugger will behave in the same way as for a standard 
breakpoint and stop for user interaction. 


Adding Hardware Instruction Breakpoints 
There two ways to add a new hardware instruction breakpoint: 


In the gutter on the left of the source file, right-click and select Add Hardware 
Code Breakpoint. Alternately, double-click in the gutter to add a standard 
breakpoint and then, in the Breakpoints view, right-click the breakpoint you just 
added and select Properties. In the last pane (Hardware) of the Properties dialog, 
select Enable Hardware Breakpoint. 


Adding Hardware Data Breakpoints 


Set a hardware data breakpoint when: 


« The debugger should break when an event (such as a read or write of a specific 
memory address) or a situation (such as data at one address matching data at 
another address) occurs. 


« Threads are interfering with each other, or memory is being accessed 
improperly, or whenever the sequence or timing of runtime events is critical 
(hardware breakpoints are faster than software breakpoints). 


Select Add Data Breakpoint from the pull-down menu in the Breakpoints to open 
the Hardware Data Breakpoint dialog, where you can create and adjust the 
properties for the breakpoint. 
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Converting Line or Expression Breakpoints Into Hardware Code Breakpoints 


To cause the debugger to request that a line or expression breakpoint be a 
hardware code breakpoint, select the Hardware check box on the Hardware tab of 
the Line Breakpoint or Expression Breakpoint dialog. 


This request does not guarantee that the hardware code breakpoint will be planted; 
that depends on whether the target supports hardware breakpoints, and if so, 
whether or not the total number supported by the target have already been 
planted. If the target does not support hardware code breakpoints, an error 
message will appear when the debugger tries to plant the breakpoint. 


NOTE: Workbench will set only the number of code breakpoints, with the specific 
capabilities, supported by your hardware. 


NOTE: If you create a breakpoint on a line that does not have any corresponding 
code, the debugger will plant the breakpoint on the next line that does have code. 
The breakpoint will appear on the new line in the Editor gutter. In the Breakpoints 
view, the original line number will appear, with the new line number in square 
brackets [] after it. 


Importing Breakpoints 


To import breakpoint properties from a file: 


1. Select File > Import > Import Breakpoints, then click Next. The Import 
Breakpoints dialog appears. 


2. Select the breakpoint file you want to import, then click Next. The Select 
Breakpoints dialog appears. 


3. Select one or more breakpoints to import, then click Finish. The breakpoint 
information will appear in the Breakpoints view, and the next time the context 
for that breakpoint is active in the Debug view, the breakpoint will be planted. 


Exporting Breakpoints 


To export breakpoint properties to a file: 
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B Internal Breakpoint Capabilities 


1. Select File > Export > Export Breakpoints, then click Next. The Export 
Breakpoints dialog appears. 


2. Select the breakpoint whose properties you want to export, and type ina file 
name for the exported file. Click Finish. 


Refreshing Breakpoints 


Right-click a breakpoint in the Breakpoints view and select Refresh Breakpoint to 
cause the breakpoint to be removed and reinserted on the target. This is useful if 
something has changed on the target (for example, you downloaded a new 
module) and the breakpoint is not automatically updated. 


To refresh all breakpoints in this way, select Refresh All Breakpoints from the 
pull-down menu in the Breakpoints view. 


Disabling Breakpoints 
To disable a breakpoint, clear its check box in the Breakpoints view. This retains all 
breakpoint properties, but ensures that it will not stop the running process. To 
re-enable the breakpoint, select the box again. 

Removing Breakpoints 


To remove a breakpoint: 


« Right-click on a breakpoint in the Editor gutter and select Remove 
Breakpoint. 


« Select a breakpoint in the Breakpoints view and select Remove. 
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Pin Terminations 


C.1 EJTAG Pin Terminations 


C.1.1 MIPS 14-Pin EJTAG Connector 


The standard MIPS 14 pin connector is as follows: 

= 14 (2by 7) 0.025” square posts 

» 0.10” between the centers of adjacent posts 

* 0.23” height of each post 

A sample connector is Samtec part number TSW-107-07-S-D. 


The pinout of this connector is shown in Figure C-1. 
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Figure C-1_ MIPS 14-Pin EJTAG Connector Pinout 


ETRST_N 1 2 GND 
ETDI 3 4 GND 
ETDO 5 6 GND 
ETMS 7 8 GND 
ETCK g 10 GND 

GRST_N 11 12 GND 

EDINT 13 14 VIO 


EJTAG Terminations 


Table C-1 contains the Wind River recommended pull-up/pull-down resistor 
values for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-1 MIPS 14-Pin EJTAG Terminations 


Signal Name Description 

ETCK External 1K pull-up 
ETM External 1K pull-up 
ETDI External 1K pull-up 
ETRST_N External 1K pull-down 
EDINT External 1K pull-up 
GRIST_N External 1K pull-up 


C.1.2 MIPS Philips 20-Pin EJTAG Connector 


Philips processors come with a 14- to 20-pin adapter that allows users to connect 
to their target. The Philips 20-pin connector is as follows: 
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C Pin Terminations 
C.1 EJTAG Pin Terminations 


= 20 (2x10) 0.016” square posts 

» 0.050” between centers of adjacent posts 

= 0.120” height of each post 

A sample connector is Samtec part number FISH-110-01-L-DV. 


The pin-out for the Philips 20-pin connector is shown in Figure C-2. 


Figure C-2. MIPS Philips 20-Pin EJTAG Connector Pinout 


Jiceg_itstn 1]/M@ Hj2 Gvp 

Jtag tddin 3|/ i Mla GND 

Jiag Idojetag pc 5] M@ Mio GND 
Jiaqgams 7|M@ MW/8 CND 
JIagick 9|  Hhaeann 
JTAG_RST 11| @ Wi l12 GNO 

Efag pcsqu) i3} ™@ Mi }i4 GND 
Etag_pest{]] 15) @ MW }146 cxp 
Efiag_ pcst2] 17| M@ WM |18 GND 
Efac_acik 19) Mi Mi |20 GND 


NOTE: There are two adapters that ship with the tools, and one of them must be 
used to connect to the target. The only difference between the two adapters is that 
on one of them the pins are rotated 180 degrees. Use whichever adapter makes 
connecting to the target easier. Ensure that Pin 1 on the adapter is correctly aligned 
with Pin 1 on the target, and also with Pin 1 on your emulator. 


EJTAG Terminations 


Table C-2 shows the Wind River recommended pull-up / pull-down resistor values 
that must be placed on the target. Signals not shown should not have 
pull-ups/pull-downs. 


93 


Wind River Workbench for On-Chip Debugging 
Board Bring-Up Guide for MIPS, 2.6.1 


Table C-2. MIPS Philips 20-Pin EJTAG Terminations 


Signal Name Description 
jtag_trst_n 10K pull-up resistor 
jtag_tdi 10K pull-up resistor 
jtag_tdo/ejtag_tpo 33 ohm series resistor 
jtag_tms 10K pull-up resistor 
jtag_tck 10K pull-up resistor 
jtag_rst 10K pull-up resistor 
ejtag_pcst[0] 33 ohm series resistor 
ejtag_pcst[1] 33 ohm series resistor 
ejtag_pcst[2] 33 ohm series resistor 


C.1.3 MIPS IDT 24-Pin EJTAG Connector 
IDT processors come with a 14 to 24 pin adapter that allows users to connect to 
their target. The IDT 24 pin connector is as follows: 
= 24 (2x12) 0.016” square posts 
» 0.050” between centers of adjacent posts 
» 0.120” height of each post 
A sample connector is Samtec part number FISH-112-01-L-DV. 


Pinouts for the IDT 24-pin connector are shown in Figure C-3. 
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C Pin Terminations 
C.1 EJTAG Pin Terminations 


Figure C-3. MIPS IDT 24-Pin ETAG Connector Pinout 


jtag trst_n 
jtag_tdi/din 
jtag_tdo/ejtag tpc 
ftag_tms 
Jtag_tek 
jtag_rst_n 


gtag_pcst(0] 


etag_pest[l] 
ejtag_pest{2] 
ejtag_delk 
@jtag_debugboot 


vio 


EJTAG Terminations 


2 GND 
4 GND 
i GND 
8 GND 
10 GND 
12 GND 
14 GND 
16 GND 
18 GND 
20 GND 
22 GND 
24 GND 


Table C-3 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-3 MIPS IDT 24-Pin EJTAG Terminations 


Signal Name 


Description 


jtag_trst_n 
jtag_tdi 
jtag_tdo/ejtag_tpo 


jtag_tms 


10K pull-up resistor 
10K pull-up resistor 
33 ohm series resistor 


10K pull-up resistor 
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Table C-3 MIPS IDT 24-Pin EJTAG Terminations 


Signal Name Description 

jtag_tck 10K pull-up resistor 

jtag_rst_n 10K pull-up resistor 

ejtag_pcst[0] 33 ohm series resistor 

ejtag_pcst[1] 33 ohm series resistor 

ejtag_pcst[2] 33 ohm series resistor 

ejtag_dclk 33 ohm series resistor 

ejtag_debugboot 10K pull-down resistor 

VIO Must be connected to the VCC I/O supply 


C.1.4 MIPS Broadcom 10-Pin EJTAG Connector 


Some Broadcom targets use the standard MIPS 14-pin connector, and some use this 
10-pin connector. Make sure you use the pinout that matches what is on your 
target. 


Broadcom processors come with a 14 to 10 pin adapter that allows users to connect 
to their target. The Broadcom 10 pin connector is as follows: 


= 10 (2x5) 0.025” square posts 

» 0.10” between centers of adjacent posts 

» 0.23” height of each post 

A sample connector is Samtec part number SSQ-105-02-T-D. 


The pin-out for the Broadcom 10-pin connector is shown in Figure C-4. 
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C.1 EJTAG Pin Terminations 


Figure C-4 MIPS Broadcom 10-Pin Connector Pinout 


TRST 1 2 GND 
TDI 3 4 GND 
IDO 6 6 GND 
IMS 7 8 GND 
TCK 9 10 GND 


EJTAG Terminations 


Table C-4 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-4 MIPS Broadcom 10-Pin EJTAG Terminations 
Signal Name Description 
TCK 1K pull-up resistor 
TMS 1K pull-up resistor 
TDI 1K pull-up resistor 
TRST 1K pull-down resistor 


C.1.5 MIPS NEC 26-Pin EJTAG Connector 
NEC processors come with a 14- to 26-pin adapter that allows users to connect to 
their target. The NEC 26 pin connector is as follows: 
* 26 (2x13) pins in a plastic shroud 
«1.27 mm between centers of adjacent posts 
* 10mm high 
A sample connector is KEL part number 8811-026-170S. 
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The pinout for the NEC 26 pin connector is shown in Figure C-5. 


Figure C-5 MIPS NEC 26-Pin EJTAG Connector Pinout 


TRCCLK Al B1 GND 
TRCDATAO A2 B2 GND 
TRCDATA1 A3 B3 GND 
TRCDATA2 A4 B4 GND 
TRCDATA3 A5 BS GND 

TRCEND A6 B6 GND 

JTDURMODE# A7 B7 GND 
JTCK A8& B&8 GND 
JTMS AQ B9 GND 
JTDO Ai0 B10 GND 
JTRST# A111 Bi1 N/C 
BRKGIO# A1i2 Bi2 NIC 
NIC A13 B13 (JTMS + 4.7K ohms) 


EJTAG Terminations 


Table C-5 shows the Wind River recommended pull-up /pull-down resistor values 
that must be placed on the target. Signals not shown should not have pull-ups or 
pull-downs. 


Table C-5 MIPS NEC 26-Pin EJTGAG Terminations 


Signal Name Description 

TRCCLK 33 ohm series resistor 
TRCDATAO 33 ohm series resistor 
TRCDATA1 33 ohm series resistor 
TRCDATA2 33 ohm series resistor 
TRCDATA3 33 ohm series resistor 
TRCEND 33 ohm series resistor 
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C Pin Terminations 
C.1 EJTAG Pin Terminations 


Table C-5 MIPS NEC 26-Pin EJTGAG Terminations 


Signal Name Description 

JTDI 1K pull-up resistor 
JTCK 1K pull-up resistor 
JTMS 1K pull-up resistor 
JTDO 33 ohm series resistor 
BRKGIO 1K pull-up resistor 


C.1.6 MIPS Toshiba 40-Pin EJTAG Connector 


Toshiba processors come with a 14- to 40-pin adapter that allows users to connect 
to their target. 


The pinout for the Toshiba 40 pin connector is shown in Figure C-6. 
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Figure C-6 MIPS Toshiba 40-Pin Connector Pinout 


TRESET 1 2 GND 
TDUDINT 3 4 GND 
TDO 5 6 GND 
TMS 7 8 GND 
TCK9 10 GND 
VCC 11 12 GND 
RESET 13 14 GND 
PCSTO 15 16 GND 
PCST1 17 18 GND 
PCST2 19 a= 
PCST3 21 22 GND 
PCST4 23 24 GND 
DCLK 25 26 GND 
PCSTS5 27 28 GND 
PCST6 29 nom 
PCST7 31 32 GND 
PCST8 33 raed 
TPC1 35 ae 
vicciax 38 GND 
TPC3 39 40 GND 
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C Pin Terminations 
C.1 EJTAG Pin Terminations 


EJTAG Terminations 


Table C-6 shows the Wind River recommended pull-up / pull-down resistor values 
for this target. Signals not shown should not have pull-ups or pull-downs. 


Table C-6 MIPS Toshiba 40-Pin EJTAG Terminations 


Signal Name Description 

TRESET 10K pull-up resistor 
TDI/DINT 10K pull-up resistor 
TDO 33 ohm series resistor 
TMS 10K pull-up resistor 
RESET 10K pull-up resistor 
PCSTO 33 ohm series resistor 
PCST1 33 ohm series resistor 
PCST2 33 ohm series resistor 
PCST3 33 ohm series resistor 
PCST4 33 ohm series resistor 
DCLK 33 ohm series resistor 
PCST5 33 ohm series resistor 
PCST6 33 ohm series resistor 
PCST7 33 ohm series resistor 
PCST8 33 ohm series resistor 
TPC1 33 ohm series resistor 
TPC2 33 ohm series resistor 
TPC3 33 ohm series resistor 
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